�L�R�|������k�H����i7X�#�E#z1���o�Qv����=cL�;�C�4`�ud�e��t^d��p���>X.�7T���^���H̶#؟Y�v�@��ģ�\���wZO���I����MIաQv���4�4����1-��=C�����my0n��]X��Ҕc��c�w(��<�L)�<I�dSM���`<���^&;�U��}�uV��D˂���!=(Ɏ=��O&P)'�����y��;��J8��$)n��(n��Ɠ���������J:jP��ږz��\��vom����b��W#�q�>y�p� @EA:��<�h�z��ɃB���� T���A~�m��"�L�f��I�A��U����`�+���G�Jw��ѝ=̫�������7��� Y��~�}g�N=�#�t�v�����c�Wܞ�o�O�CDB�h�.�bAg]t&S]�(V��塿Ά�h�Vjk�<�h��o$�Z���G�a5mԦ ���{�L�"(Yw�W'�QU�P�slA�?�//)V���K��i��n���I�ǒa��E�!��q��I�8��B�����f}����9�B�,v{����Ҹ�s��v�U������Jw�`p{�c���.�)��'-g��^vn������7̘\S>���X<j��� ��tf���<��R��Ʃ���y�; ��}Z��-�5ժ���w�R�S�.+p"����ݥ[6 }�~�iU��5�!/��J�?�\�j��f)�C�>DV&�#��sVԋ(AD��`��Z�OʜP�n��@���V��T]ݍ*�,��� ��n��'��Y�X��"���� �F�;WC$ rb����e��}�y3�M��dOg�g�1U}�3";��>7��)�'���V5ʬ3�0t��ץ�Q.ɤW�0�3&����H9��k����J��g6AJF���iR(7���/��ޠ��H+;��l��+z�gt���]\G&n���* �F��\|u����Y���&�ݕ��j���(X�2��)0��:���O�'��G�`�`FA�����i�Z��$1[Nfh��9����r��4���[�G� ,w��� D�vP��$9���2�U�ܔ�g��.�IT�+C�9��!{<#r?�Er��[����h�S��=|j��?�����Vd77�*�/�}��2V��7�܉���Ph�)>b%���W��0x��F���n躆�n�F�� |�*w[��ɒ��oZ��P�nw8�W�,�� ������p��U&jƄ��z�����N9CN�h�d���ڣ��1ق���KY�7���wY��J�|N^�1��Za��F�a�0���g�Ї���&�i��S,����m)V>�o���ۄ�6������G�$ޱ�t�H(:�4���k�o�5��mD9ē��3�9T u�MYhK�'�$%�0aA���2c7 ���괣@jk;�@�OF�P����)���/��r��U'��l��* T$�R���n�}�&�0��挘7�n{����ƫ��ɑ��>�u��]S����/�z��t-��v�!��l���;������UG�;���p�*���@��J�b7�$����wz���� 3� J ��6�فW�1FQ�8�8~ڒ�V?�?���Zؾ�ov!��_���[�$�*�?��S�\���.`TXݴ��I���v���}mB �Zb%�@#��{��1l�/���<������.�3��+,��bf<;�0��J��#'���+���¸%��t�)ܻ��,ǽeo5�p�O.�h�;�����¡�M���\<�F�������O7W� �Q4E=l������V�4�6p`�����qx��}�<b}�[�)��_>��vi�R���s�ڟd��ſ�z�#�ّ�]GWY�:l=�CPs��CZݝ����M�|i�b�VD�����OB�J�C/[î��J�U�-5^���9��kAY�����g&��B��:w���Ş ̚���B �t7�i� Å!-���ap�=�R�(Xd���n0���)V���D�C!qm�\��}��|����p��1��/\fw?�{z��<���?�[�k�֝l�DADw��g^5��/h�^���^<Q�`�9�R�y��UG%��N�?s|С�-,8���q���(A@�wD��{���X�������� 1ov;ΪDc�O\��D�U2\t�䋊��3L�d �J���K��ZP�3&R�-�Hʣ�&x�fY���������I�z�wi-�Gm8FH��O���2:�f��k'g_h�eEs|�0f`�m0���ɴY��W//��L����}��O��Yo/��i-���g�����l�iֆ�[�AA�Ǚ�+�BI[�0��F���b��y.��������7Üa�$z�0��C�X�<�I��T@!�����������\���gxm�.�=��I? �Tk;�����S������Le}NW3�o���)ì���F��h�w�y�ՕU�1��w?� �mӞc(U s�oK���_�oh-f����gk�\o����d�͆!#~æ��r�MrVQ9�j�{U��a.^L�A'�k��>>\u��V1e�M�u� �=���x������������(�u���#?RR�H���7M�������%l�?B� ��Q߃s�\��|�����&k�*{����v�Z���%��2\M��^���be#?���&���LW8t1ǂe>�m�r2���A�K�2"\F��ۢ��Wc�T�%�=��d8p������,��٦�� �5��"?4����H�u��TZ����N�ќ��v���r���XJ;,����� ��1� -��?J�,M��}��m)2�f2�������%�҇����� mu�Ә_qݓݷ{bJq�`|�q��qo�'�OA?�%W#�=9���G��P�Fr�Vh�%a��ށ�����Nxl�xGG%Q,��t&z��=X��𤽜b��=���lE�M<���N�m�����J�`�,���$m]Y5�皱����˞J��ƴmZ�&�r si��]�F��hi���
Static task
static1
Behavioral task
behavioral1
Sample
Quantum_Services_Internal.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Quantum_Services_Internal.exe
Resource
win10v2004-20231215-en
General
-
Target
Quantum_Services_Internal.exe
-
Size
6.3MB
-
MD5
ad099114c32ddd6551d55e79f5f63162
-
SHA1
15b1f89d382f3982e4e29216d1c8e0ef0f7bde93
-
SHA256
956f789925169696020d02d052a649bd1a7ef81ced1695afba18f3896f64e8c9
-
SHA512
659b6424c690b307797fb5d86b9e36835a65d9806905577beac27caaf2e8fdd1ae50ab57411856492f291d5b72563ed7ae6880d865646d0a405764c3d1dcb7cb
-
SSDEEP
196608:LAk+hDVTRpvAqcfngW7mU7yLXnWVcwTb6B:LANhDtvA3gGmU7KXWCwTb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Quantum_Services_Internal.exe
Files
-
Quantum_Services_Internal.exe.exe windows:6 windows x64 arch:x64
eff1ed42631c719660195631799a5db2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
CharUpperBuffW
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
psapi
GetModuleInformation
normaliz
IdnToAscii
wldap32
ord301
ws2_32
getaddrinfo
rpcrt4
UuidCreate
userenv
UnloadUserProfile
winhttp
WinHttpSendRequest
ntdll
RtlLookupFunctionEntry
iphlpapi
GetAdaptersInfo
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strpbrk
crypt32
CertFreeCertificateChain
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l(# Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.l3~ Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.2&" Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ