666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe
Size 395KB
Sample240406-1pfcysca2s
SHA256 666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4
MD5 395b915a64e797a36265b956ac90b409
SHA1 fbe914bafb83ae22f86c7e82dabc0b04e7fa5b00
SHA512 9c1eb30f5ffc45fc1a72635203376fd0466b03224e792a40818602652c04d53ac99ec71611054e4534991aa5e4f818d73623208e3f8687bc7ad214b7f8af5c62
SSDEEP 6144:4jlYKRF/LReWAsUyjxvbmNYmKTSRtjNAxtp+oVgKlOJQ6d:4jauDReW9dbmNYw1NAxioVgKluQ6d
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	qlkbsn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\qlkbsn.exe"	qlkbsn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1968	1716	666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe	88
PID 1716 wrote to memory of 1968	1716	666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe	88
PID 1716 wrote to memory of 1968	1716	666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe	88

C:\Users\Admin\AppData\Local\Temp\666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe
"C:\Users\Admin\AppData\Local\Temp\666e62e6dba72a7662799bf567507d87f20e9793aa88f4a229e26e40dc9abbd4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\ProgramData\qlkbsn.exe
  "C:\ProgramData\qlkbsn.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DumpStack.log.tmp .exe

Path C:\DumpStack.log.tmp .exe
Size 395KB
SHA256 b9c60e42c6a0221359ceae1c0b28878be50223f34652776332563f179930d83d
MD5 fbc069b1a9a9ea4e2f36b3d322cd2ee7
SHA1 070a52ecd2f3fa59ad5a5c00c1a28cd2232dc8d7
SHA512 b3377b739f5b5f411355395cbccf528720e5adb26929b0d529515aaf82227cc6672c9a1060570ecb770c77121993dfa549dae9d36888fbe5405ae9d686376786
SSDEEP 6144:4jlYKRF/LReWAsUyA1oDfzhu/FtzcFbvMX4HTMpCoWVHLQpAKE6+AP9:4jauDReWzfzhSzcFrMX6MzWVLWT9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mira.h

Path C:\ProgramData\Saaaalamm\Mira.h
Size 136KB
SHA256 f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
MD5 cb4c442a26bb46671c638c794bf535af
SHA1 8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA512 074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3
SSDEEP 1536:8fjj+VDJ2Y1XJ2xH7Z3CPRs/sYuQrR7qKFFdr8uveDgK2FgGdFXCFnsUo6Ge/ASC:EjjSMY1XoRCP+/33rReWIVZvFsU5Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

qlkbsn.exe

Path C:\ProgramData\qlkbsn.exe
Size 258KB
SHA256 1ae01164f042874e1c16ef6c069b07e6af49b127443ac39cb5cccf928770cd7e
MD5 e9d50544f96ac26bbd870a4beceb5912
SHA1 32cda6bc3ad9c080289906d229cb715a90a3735c
SHA512 638949ec14018540847745aff09dba921dc59b68584f7f9ab6d0a4b18b3a5f5cc095d83d333916bcf5fee109dbc3478951acb1db3abb23766a7bbfd2c8d6a114
SSDEEP 6144:OO2Wwqr+D5V4GDaFswO6Fz0sKy7Nu1ZPmG9jn+WGZO5t3UvAYZqkDvdUC1TgHVGg:Pjwqr+D5V4EwO6Fz0sK+oPmG9jnbGYqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1716-0-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/1716-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/1716-9-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/1968-130-0x0000000000400000-0x0000000000448000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads