Analysis
-
max time kernel
162s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 02:14
Static task
static1
Behavioral task
behavioral1
Sample
24252e6b573e398f3161fb58bdccce1b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
24252e6b573e398f3161fb58bdccce1b.exe
Resource
win10v2004-20231215-en
General
-
Target
24252e6b573e398f3161fb58bdccce1b.exe
-
Size
136KB
-
MD5
24252e6b573e398f3161fb58bdccce1b
-
SHA1
5964ee2c21cd3f331e1661f78df983a4dace6a29
-
SHA256
ea2efbc48f7257e184a90e50698640df4afccf383e977e1f21b3dedcd2040ae7
-
SHA512
4566b08f24bf3f2d913c3814c53ab7c515231b6bd0fe4adf1f0c3e7ae312342395e68b5c4c1184d424832ee4a55d25251b6fb8d763f7f5b626aa06dfcce4f921
-
SSDEEP
3072:zrnnbX8b3xcFKpcgtHonOkeD4eNhn8iTS2nIM64:zrz8bZpxtEOlD468i/IV
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 4 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exefddlqt.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqtde.exe 24252e6b573e398f3161fb58bdccce1b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqtde.exe 24252e6b573e398f3161fb58bdccce1b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqtde.exe fddlqt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dqtde.exe fddlqt.exe -
Executes dropped EXE 2 IoCs
Processes:
fddlqt.exefddlqt.exepid process 4600 fddlqt.exe 4232 fddlqt.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fddlqt.exe24252e6b573e398f3161fb58bdccce1b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gpruikoe = "C:\\Users\\Admin\\AppData\\Local\\fddlqt.exe" fddlqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gpruikoe = "C:\\Users\\Admin\\AppData\\Local\\fddlqt.exe" fddlqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gpruikoe = "C:\\Users\\Admin\\AppData\\Local\\fddlqt.exe" 24252e6b573e398f3161fb58bdccce1b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gpruikoe = "C:\\Users\\Admin\\AppData\\Local\\fddlqt.exe" 24252e6b573e398f3161fb58bdccce1b.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exefddlqt.exedescription pid process target process PID 3340 set thread context of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 4600 set thread context of 4232 4600 fddlqt.exe fddlqt.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exe24252e6b573e398f3161fb58bdccce1b.exefddlqt.exedescription pid process target process PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3340 wrote to memory of 464 3340 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 464 wrote to memory of 2488 464 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 464 wrote to memory of 2488 464 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 464 wrote to memory of 2488 464 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 464 wrote to memory of 4600 464 24252e6b573e398f3161fb58bdccce1b.exe fddlqt.exe PID 464 wrote to memory of 4600 464 24252e6b573e398f3161fb58bdccce1b.exe fddlqt.exe PID 464 wrote to memory of 4600 464 24252e6b573e398f3161fb58bdccce1b.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe PID 4600 wrote to memory of 4232 4600 fddlqt.exe fddlqt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\fddlqt.exe"C:\Users\Admin\AppData\Local\fddlqt.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\fddlqt.exe"C:\Users\Admin\AppData\Local\fddlqt.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\fddlqt.exeFilesize
136KB
MD524252e6b573e398f3161fb58bdccce1b
SHA15964ee2c21cd3f331e1661f78df983a4dace6a29
SHA256ea2efbc48f7257e184a90e50698640df4afccf383e977e1f21b3dedcd2040ae7
SHA5124566b08f24bf3f2d913c3814c53ab7c515231b6bd0fe4adf1f0c3e7ae312342395e68b5c4c1184d424832ee4a55d25251b6fb8d763f7f5b626aa06dfcce4f921
-
memory/464-22-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/464-2-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/464-4-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/464-5-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3340-1-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/3340-0-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/4232-31-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-29-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-21-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-36-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-24-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-25-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-26-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-27-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-28-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-30-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-35-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-32-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-33-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4232-34-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4600-14-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/4600-13-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB