Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 21:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6d96522d4ec2f190d783083513be193.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6d96522d4ec2f190d783083513be193.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c6d96522d4ec2f190d783083513be193.exe
-
Size
260KB
-
MD5
c6d96522d4ec2f190d783083513be193
-
SHA1
630c4e72a384a12ae4ca79558679080749310041
-
SHA256
3c9a3cf11c17e7d446098180be000f0e06c9c4509bcb1499047c2ca7ba723d69
-
SHA512
cadc28bf9f0e13d177e1ea63e48fbe45d5aa360942437ccde1733b9d0f14708865667b91241b403f0191efb7b4fb26c216835a31dfac8553d33bc5fa53155808
-
SSDEEP
6144:x4HSAtOUUp7WQn6mr1R4bKLnXejKloO6JU1J7QnpRZ7Ta9kzU2/pn:xkSAt4p6Qn6mr1R4bKLnXaKaO6O1JApv
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qkdiis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation c6d96522d4ec2f190d783083513be193.exe -
Executes dropped EXE 1 IoCs
pid Process 2756 qkdiis.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /Z" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /b" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /q" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /g" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /i" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /R" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /J" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /V" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /m" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /A" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /C" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /I" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /a" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /d" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /y" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /K" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /r" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /B" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /t" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /P" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /j" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /O" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /n" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /p" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /T" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /U" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /N" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /X" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /Y" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /E" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /l" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /Q" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /u" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /L" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /D" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /o" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /k" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /S" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /h" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /G" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /M" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /z" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /s" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /F" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /v" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /H" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /W" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /x" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /f" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /e" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /c" qkdiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qkdiis = "C:\\Users\\Admin\\qkdiis.exe /w" qkdiis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe 2756 qkdiis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3716 c6d96522d4ec2f190d783083513be193.exe 2756 qkdiis.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3716 wrote to memory of 2756 3716 c6d96522d4ec2f190d783083513be193.exe 91 PID 3716 wrote to memory of 2756 3716 c6d96522d4ec2f190d783083513be193.exe 91 PID 3716 wrote to memory of 2756 3716 c6d96522d4ec2f190d783083513be193.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6d96522d4ec2f190d783083513be193.exe"C:\Users\Admin\AppData\Local\Temp\c6d96522d4ec2f190d783083513be193.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\qkdiis.exe"C:\Users\Admin\qkdiis.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD536e563d675de34487d26540e6c356aa0
SHA16b512ab909eaaaa35b5acfacc943211833ffe544
SHA256523a57c37b66b50212b947ee46f28d5a5e024b97f03b0856d63eadbe66669168
SHA512611c4d959e3db28aab699ba47e7bf532dc8e0997ad4ff283249da81fbb4361d3744a543f5fffc6409f1f9d0dcb907a2859cb3dc0cdfd1e56eae8ce73bf6f675d