Overview
overview
8Static
static
3QDeskSetup1.1.1.6.exe
windows7-x64
7QDeskSetup1.1.1.6.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3D3DCompiler_43.dll
windows7-x64
1D3DCompiler_43.dll
windows10-2004-x64
1D3DX9_43.dll
windows7-x64
1D3DX9_43.dll
windows10-2004-x64
1VMProtectSDK64.dll
windows7-x64
1VMProtectSDK64.dll
windows10-2004-x64
1avcodec-58.dll
windows7-x64
1avcodec-58.dll
windows10-2004-x64
1avdevice-58.dll
windows7-x64
1avdevice-58.dll
windows10-2004-x64
1avfilter-7.dll
windows7-x64
1avfilter-7.dll
windows10-2004-x64
1avformat-58.dll
windows7-x64
1avformat-58.dll
windows10-2004-x64
1avutil-56.dll
windows7-x64
1avutil-56.dll
windows10-2004-x64
1breakpad.dll
windows7-x64
1breakpad.dll
windows10-2004-x64
1d3dx11_43.dll
windows7-x64
1d3dx11_43.dll
windows10-2004-x64
1driver/devcon.exe
windows10-2004-x64
1driver/idd...dd.dll
windows10-2004-x64
1driver/install.bat
windows7-x64
1driver/install.bat
windows10-2004-x64
8Analysis
- max time kernel
118s - max time network
122s - platform
windows7_x64 - resource
win7-20240319-en - resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system - submitted
29/03/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
QDeskSetup1.1.1.6.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
QDeskSetup1.1.1.6.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
D3DCompiler_43.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
D3DCompiler_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
D3DX9_43.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
D3DX9_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
VMProtectSDK64.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
VMProtectSDK64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
avcodec-58.dll
Resource
win7-20240319-en
Behavioral task
behavioral16
Sample
avcodec-58.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
avdevice-58.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
avdevice-58.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
avfilter-7.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
avfilter-7.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
avformat-58.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
avformat-58.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
avutil-56.dll
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
avutil-56.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
breakpad.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
breakpad.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
d3dx11_43.dll
Resource
win7-20240319-en
Behavioral task
behavioral28
Sample
d3dx11_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
driver/devcon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
driver/idd/qdeskidd.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
driver/install.bat
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
driver/install.bat
Resource
win10v2004-20240226-en
General
- Target QDeskSetup1.1.1.6.exe
- Size 10.1MB
- Sample240329-nzkdfagg89
- SHA256 4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf
- MD5 413fd3e1d20e10b93ceb366b51bf6f53
- SHA1 e8a7d0c2ad2b4f923b56edecb547304f433eda07
- SHA512 9b90b7ff03decc5154cc8e07a40e0d7f73fe7e110809550957d3fc841526c62a6ca785c417ae717e9cad7ebd3cc96fbb96d304933fc5b79b26c71e27f85081fd
- SSDEEP 196608:FC6Dc8zspBYxPYvYWAi19y5bx+ys/4OLQAFzTk9xRCk2KINKwXOIdpyVJ6:Fvzsp3vYm85b8yslZTcF8tXkI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2024 QDeskSetup1.1.1.6.exe 2024 QDeskSetup1.1.1.6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 QDeskSetup1.1.1.6.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nso3620.tmp\ioSpecial.ini
- Size 706B
- SHA256 9533d92f0f999877b787d663982ff7c4237fbfa18d3c173cd7d8dd162a842971
- MD5 9e852ff7375b83b21c9fa0d94379eb29
- SHA1 0f9b35a414aed1c4b339c4f7fb13eed0e08a37eb
- SHA512 0d21191bc68435f784ad7df772af3c9c1a2f6e29fc8528258e27c478229df5f4a7479728436a26599c2f09b5b7f928d28965e7e41407197beda748b86f329ea8
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nso3620.tmp\InstallOptions.dll
- Size 14KB
- SHA256 0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
- MD5 20f3184efe7edddfef3325efc25d12a5
- SHA1 8db4c500d73f9525a7e9834df6caea2e70189939
- SHA512 433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
- SSDEEP 192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso3620.tmp\LangDLL.dll
- Size 5KB
- SHA256 4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
- MD5 ea60c7bd5edd6048601729bd31362c16
- SHA1 6e6919d969eb61a141595014395b6c3f44139073
- SHA512 f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
- SSDEEP 48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd
- MD5 SHA1 SHA512 SSDEEP