Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38a383e4b61a9a8e373d7504dbbe9e26.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
38a383e4b61a9a8e373d7504dbbe9e26.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
38a383e4b61a9a8e373d7504dbbe9e26.exe
-
Size
52KB
-
MD5
38a383e4b61a9a8e373d7504dbbe9e26
-
SHA1
b0ad72a57d8d40e6cf17998d9d39d45dc7293480
-
SHA256
ef6f0f6d252a91f22e251069e6fa02b65c5beba1f1738d81ddd5352039e8f53b
-
SHA512
45bf8f176ac17dd86eb7abd6266829e4231e1ae150fccd306c4f64b433f98ddca147eb21a2eed2d73846bd43f11a3013440e238d959fc15b2cb92848e1feb840
-
SSDEEP
768:uPWn6wcIvMfFej/znY1jskr/v/m89S3rkC6R+wibw52Tzp/u:uxqMfIvYNskr3mbkC6R+Xp/u
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rqger.exe -
Executes dropped EXE 1 IoCs
pid Process 2080 rqger.exe -
Loads dropped DLL 2 IoCs
pid Process 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\rqger = "C:\\Users\\Admin\\rqger.exe" rqger.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe 2080 rqger.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 2080 rqger.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2080 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 28 PID 1720 wrote to memory of 2080 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 28 PID 1720 wrote to memory of 2080 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 28 PID 1720 wrote to memory of 2080 1720 38a383e4b61a9a8e373d7504dbbe9e26.exe 28 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27 PID 2080 wrote to memory of 1720 2080 rqger.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\38a383e4b61a9a8e373d7504dbbe9e26.exe"C:\Users\Admin\AppData\Local\Temp\38a383e4b61a9a8e373d7504dbbe9e26.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\rqger.exe"C:\Users\Admin\rqger.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5848f58bf3528a889eb28a04cc4b8b707
SHA12444d2aa2d48fd57b324ce8fc93ecb0dcab19305
SHA2568f73dd8f0dcd46a15a9f909d102a8dfa7c5e9d94f22c5f4b073419fdfe37ea31
SHA51255792db7643be9121935b665ed80d0f5a09c2e0928ac64c1e5b92d022acab94b2da22163d52b6c85ecbfd9db8a80a967e83be7ed21dd0b2eafb363a8cbf0e302