Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 11:50

General

  • Target
    QDeskSetup1.1.1.6.exe
  • Size 10.1MB
  • Sample240329-nzkdfagg89
  • SHA256 4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe
    "C:\Users\Admin\AppData\Local\Temp\QDeskSetup1.1.1.6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ioSpecial.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\ioSpecial.ini
        • Size 706B
        • SHA256 9533d92f0f999877b787d663982ff7c4237fbfa18d3c173cd7d8dd162a842971
        • MD5 SHA1 SHA512

        InstallOptions.dll

        • Path \Users\Admin\AppData\Local\Temp\nso3620.tmp\InstallOptions.dll
        • Size 14KB
        • SHA256 0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
        • MD5 SHA1 SHA512 SSDEEP

        LangDLL.dll

        • Path \Users\Admin\AppData\Local\Temp\nso3620.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
        • MD5 SHA1 SHA512 SSDEEP