Overview
overview
10Static
static
10TCQLDD.apk
android-9-x86
1kqkticwjgzy.dat
windows7-x64
3kqkticwjgzy.dat
windows10-2004-x64
3l41740f07_a32.so
debian-9-armhf
1l41740f07_a64.so
ubuntu-18.04-amd64
l41740f07_a64.so
debian-9-armhf
l41740f07_a64.so
debian-9-mips
l41740f07_a64.so
debian-9-mipsel
l41740f07_x64.so
ubuntu-18.04-amd64
1l41740f07_x86.so
ubuntu-18.04-amd64
1Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
25-10-2023 04:15
Behavioral task
behavioral1
Sample
TCQLDD.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
kqkticwjgzy.dat
Resource
win7-20231023-en
Behavioral task
behavioral3
Sample
kqkticwjgzy.dat
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
l41740f07_a32.so
Resource
debian9-armhf-20231023.1-en
Behavioral task
behavioral5
Sample
l41740f07_a64.so
Resource
ubuntu1804-amd64-20231023-en
Behavioral task
behavioral6
Sample
l41740f07_a64.so
Resource
debian9-armhf-20231023.1-en
Behavioral task
behavioral7
Sample
l41740f07_a64.so
Resource
debian9-mipsbe-20231020-en
Behavioral task
behavioral8
Sample
l41740f07_a64.so
Resource
debian9-mipsel-20231023-en
Behavioral task
behavioral9
Sample
l41740f07_x64.so
Resource
ubuntu1804-amd64-20231023-en
Behavioral task
behavioral10
Sample
l41740f07_x86.so
Resource
ubuntu1804-amd64-20231023-en
General
-
Target
kqkticwjgzy.dat
-
Size
2KB
-
MD5
6b1c53de635ec1415aaac4aa29d22548
-
SHA1
88aed7f3d86dce2fd168ae4890c8014e6272062d
-
SHA256
44a33711b2353fe2b338167373064182cf7b16bb322c60dd36a649f429427a19
-
SHA512
4fc246c6bf0efa71b511950210a2154f4afdb045de8b6772d01854cdb6847970b0017d6a089eb97d7447ef608a6b90af2e62de44d664963e4530885cad6b5286
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.dat\ = "dat_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.dat rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 2668 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid Process 2668 AcroRd32.exe 2668 AcroRd32.exe 2668 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid Process procid_target PID 2460 wrote to memory of 2640 2460 cmd.exe 29 PID 2460 wrote to memory of 2640 2460 cmd.exe 29 PID 2460 wrote to memory of 2640 2460 cmd.exe 29 PID 2640 wrote to memory of 2668 2640 rundll32.exe 30 PID 2640 wrote to memory of 2668 2640 rundll32.exe 30 PID 2640 wrote to memory of 2668 2640 rundll32.exe 30 PID 2640 wrote to memory of 2668 2640 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\kqkticwjgzy.dat1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\kqkticwjgzy.dat2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\kqkticwjgzy.dat"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5342216ddcbb272fbfde2338064bc1236
SHA158c30ad4d7f083f11e5024c8c8cd9a2f0912e7af
SHA2561cec93893dae5ac0e79811bd762f5d2354b27599878b0b156024280b45e69f5e
SHA5129408b8a749cb339fcc3f8f8ecf687abb2a816b27b3fbc7de067fbe7658f834318d0371df91a1c8c2b04d52c6d4e4c5fc9daf66e59d9eb31a66d28c6ff1c8e1d8