cb16788d308cca93ddf022ff66077827cc9c38e1b6fdca9f0ea1fb1829d0ef52

Analysis

max time kernel
145s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:12

Target

1c99460030a6df2a7b93c232a383a625.exe
Size

9KB
MD5

1c99460030a6df2a7b93c232a383a625
SHA1

94bf8944e470ce4aa8dd5f42495cb4c8a81bf6b3
SHA256

cb16788d308cca93ddf022ff66077827cc9c38e1b6fdca9f0ea1fb1829d0ef52
SHA512

424f81818f7b9198765dcd7585894c4f5be61237ee32b63ce000e60a8b81ac45c6ce4f13cc3d0d3707005e933cb227fd64576ef8c9dc9211b395591e3e92a35a
SSDEEP

192:xPtG9CSTjRlKwa+0sbCNVRkq1lrgxDfSIwN9leMxO8mUptCCDSap:xPtgCmlKg0vM6tHleMxO8mItXmY

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4832	1c99460030a6df2a7b93c232a383a625.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cqdoor0.dll	1c99460030a6df2a7b93c232a383a625.exe
File opened for modification	C:\Windows\SysWOW64\cqdoor0.dll	1c99460030a6df2a7b93c232a383a625.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04A0CB31-4EB8-889B-FDEB-E00ED87BCE23}\daSobjEventName = "YUTDFGHKHCOOLCQ_0"	1c99460030a6df2a7b93c232a383a625.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04A0CB31-4EB8-889B-FDEB-E00ED87BCE23}	1c99460030a6df2a7b93c232a383a625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04A0CB31-4EB8-889B-FDEB-E00ED87BCE23}\daExeModuleName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1c99460030a6df2a7b93c232a383a625.exe"	1c99460030a6df2a7b93c232a383a625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04A0CB31-4EB8-889B-FDEB-E00ED87BCE23}\daDllModuleName = "C:\\Windows\\SysWow64\\cqdoor0.dll"	1c99460030a6df2a7b93c232a383a625.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	1c99460030a6df2a7b93c232a383a625.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3420	4832	1c99460030a6df2a7b93c232a383a625.exe	48

memory/4832-5-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/4832-6-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download