7ffc31f911e2873fca65b79ef057aad72e29c7047f150473c5553e6a41e4577d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c62eb5fa9def476d015175a3de49fb19.dll
Size

31KB
MD5

c62eb5fa9def476d015175a3de49fb19
SHA1

da824972b8651a6bba069644b7234bc277952b12
SHA256

7ffc31f911e2873fca65b79ef057aad72e29c7047f150473c5553e6a41e4577d
SHA512

fc5621a71fb6b75cecabf87dbb19a3516c2fb9a01f2426d599ca83b6b372d8b6a56f4bbff7a5ae4aaf3584acff4c7fe8887da7f03f4417bbb283036c56bc338b
SSDEEP

768:t7go0NDu3w/HJS2azetaIFHqJspY+LHjJC:t7W5u6w21DpY+L1C

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe\Debugger = "ntsd -d"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28
PID 2020 wrote to memory of 1696	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62eb5fa9def476d015175a3de49fb19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c62eb5fa9def476d015175a3de49fb19.dll,#1
  2⤵
  - Sets file execution options in registry
  - Suspicious use of SetWindowsHookEx
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads