c2eb1b14cffec35b06db95366ea2306ab8a0886c8ca14d76e6903c84ee11d04c

Analysis

max time kernel
120s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RQM-0876789009800P0.exe
Size 683KB
Sample231024-f91t6sah21
SHA256 c2eb1b14cffec35b06db95366ea2306ab8a0886c8ca14d76e6903c84ee11d04c
MD5 b8ebfae29a4e44c39b58e2125babff9d
SHA1 9ecbec0d345e86b860b5af170c427129959933fc
SHA512 36b852954a7a47ad6ea921bfda1004ccb26429b1a59f73e8ec5679576efc33d58eee4626037638c655c6f4493fb6ed64d0ba7aaf755de44c401d4ff8f968c678
SSDEEP 12288:jXZmPygxEQvLklrp6yMwvB6BBmtsM2PHnKQwQh111XPweY3phxc4Mvn9UNZl77LI:jXZGyUEQvI95LvB6/mtcPHpwQh1n/0pW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4076	qkwinv.exe
500	qkwinv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\llueeajjs = "C:\\Users\\Admin\\AppData\\Roaming\\uqqavvfookttd\\yiiennwsscllhq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\qkwinv.exe\" "	qkwinv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 500	4076	qkwinv.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4076	qkwinv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
500	qkwinv.exe
500	qkwinv.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4076	4368	RQM-0876789009800P0.exe	83
PID 4368 wrote to memory of 4076	4368	RQM-0876789009800P0.exe	83
PID 4368 wrote to memory of 4076	4368	RQM-0876789009800P0.exe	83
PID 4076 wrote to memory of 500	4076	qkwinv.exe	84
PID 4076 wrote to memory of 500	4076	qkwinv.exe	84
PID 4076 wrote to memory of 500	4076	qkwinv.exe	84
PID 4076 wrote to memory of 500	4076	qkwinv.exe	84

C:\Users\Admin\AppData\Local\Temp\RQM-0876789009800P0.exe
"C:\Users\Admin\AppData\Local\Temp\RQM-0876789009800P0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\qkwinv.exe
  "C:\Users\Admin\AppData\Local\Temp\qkwinv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\qkwinv.exe
    "C:\Users\Admin\AppData\Local\Temp\qkwinv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fvfuxhluwf.ei

Path C:\Users\Admin\AppData\Local\Temp\fvfuxhluwf.ei
Size 777KB
SHA256 83c873fa281fe0bb229cd7a23d4237fb500edb53662afd5d84a24abd7482f150
MD5 4f9531f2ca05c4790f7f7d5b21fd6fe0
SHA1 8ee85b88489e38ea06b4dd0e42158b043a0a676e
SHA512 65597e4c2852fd72d6fe9eca43a8d0ceecb2ae34566ae749ed11a56e19ea38d67e9997eaea5c466c8ae1ceab6edbd48a83ab9710013cf72a5a9ffafa9c7e316c
SSDEEP 24576:xualkWFKt7wwdXFRqNefQaAZnjf2KgiDg:xu/WM7wwpFWeIaAZnjf2Ss
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkwinv.exe

Path C:\Users\Admin\AppData\Local\Temp\qkwinv.exe
Size 164KB
SHA256 f001997ecf2fd060d6a4dda188cfb1bf9747ec41f8a3937e9528b1074fdf82cc
MD5 9b570c1d332e9b8c4e526a159449b811
SHA1 fa41d384929f94ad10bb9e5b1e8074beb5091e4f
SHA512 f0940c81d37d92738c53d6035360191504ccd3b218b9b80bc8d3352b5964f6c219a8ddb823ba8dc3dc31a7a9cbc64d397cafa414a32f7f2f4e8934794b7933a6
SSDEEP 3072:UFmrP4G4yqC7BN4jKJsC1mh8Souq6RJqeYF/jfabdqXevancx+HdYl3B5cQx7:UEVkW1mRDzfYFjfabVvFOk3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkwinv.exe

Path C:\Users\Admin\AppData\Local\Temp\qkwinv.exe
Size 164KB
SHA256 f001997ecf2fd060d6a4dda188cfb1bf9747ec41f8a3937e9528b1074fdf82cc
MD5 9b570c1d332e9b8c4e526a159449b811
SHA1 fa41d384929f94ad10bb9e5b1e8074beb5091e4f
SHA512 f0940c81d37d92738c53d6035360191504ccd3b218b9b80bc8d3352b5964f6c219a8ddb823ba8dc3dc31a7a9cbc64d397cafa414a32f7f2f4e8934794b7933a6
SSDEEP 3072:UFmrP4G4yqC7BN4jKJsC1mh8Souq6RJqeYF/jfabdqXevancx+HdYl3B5cQx7:UEVkW1mRDzfYFjfabVvFOk3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkwinv.exe

Path C:\Users\Admin\AppData\Local\Temp\qkwinv.exe
Size 164KB
SHA256 f001997ecf2fd060d6a4dda188cfb1bf9747ec41f8a3937e9528b1074fdf82cc
MD5 9b570c1d332e9b8c4e526a159449b811
SHA1 fa41d384929f94ad10bb9e5b1e8074beb5091e4f
SHA512 f0940c81d37d92738c53d6035360191504ccd3b218b9b80bc8d3352b5964f6c219a8ddb823ba8dc3dc31a7a9cbc64d397cafa414a32f7f2f4e8934794b7933a6
SSDEEP 3072:UFmrP4G4yqC7BN4jKJsC1mh8Souq6RJqeYF/jfabdqXevancx+HdYl3B5cQx7:UEVkW1mRDzfYFjfabVvFOk3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/500-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/500-11-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/500-15-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4076-5-0x0000000002190000-0x0000000002192000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads