Analysis

  • max time kernel
    132s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2024 08:20

General

  • Target

    QWhale.Common.dll

  • Size

    192KB

  • MD5

    ac80e3ca5ec3ed77ef7f1a5648fd605a

  • SHA1

    593077c0d921df0819d48b627d4a140967a6b9e0

  • SHA256

    93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

  • SHA512

    3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

  • SSDEEP

    1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\QWhale.Common.dll,#1
    1⤵
      PID:4656
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:1020
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:692

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/692-0-0x000001FC12C40000-0x000001FC12C50000-memory.dmp

        Filesize

        64KB

      • memory/692-16-0x000001FC12D40000-0x000001FC12D50000-memory.dmp

        Filesize

        64KB

      • memory/692-32-0x000001FC1B070000-0x000001FC1B071000-memory.dmp

        Filesize

        4KB

      • memory/692-34-0x000001FC1B0A0000-0x000001FC1B0A1000-memory.dmp

        Filesize

        4KB

      • memory/692-35-0x000001FC1B0A0000-0x000001FC1B0A1000-memory.dmp

        Filesize

        4KB

      • memory/692-36-0x000001FC1B1B0000-0x000001FC1B1B1000-memory.dmp

        Filesize

        4KB