Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 02:41
Static task
static1
Behavioral task
behavioral1
Sample
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe
Resource
win10v2004-20240412-en
General
-
Target
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe
-
Size
210KB
-
MD5
dc49b618cc414c7bb8eb51d83cff719d
-
SHA1
47c7bb2c52be285a9f764a0478d86479c635fe3d
-
SHA256
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2
-
SHA512
b11385906a482fdd923a0f788190ca6b164964aec86d7db068f2978d64bbab301884c81820542520b9e9b3dc280373892f5e3091de565940fdd172bab8c032ad
-
SSDEEP
6144:uVtV0QPQCnSQsTEWYChnUnPJuHC3vcWY:ubVQk1wnGACvc
Malware Config
Signatures
-
Detects executables containing base64 encoded User Agent 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-27-0x0000000010000000-0x0000000010054000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent behavioral1/memory/2528-29-0x0000000010000000-0x0000000010054000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent -
Deletes itself 1 IoCs
Processes:
iamqo.exepid process 2156 iamqo.exe -
Executes dropped EXE 2 IoCs
Processes:
iamqo.exepen.exepid process 2156 iamqo.exe 2528 pen.exe -
Loads dropped DLL 7 IoCs
Processes:
cmd.exeiamqo.exepen.exepid process 2064 cmd.exe 2064 cmd.exe 2156 iamqo.exe 2528 pen.exe 2528 pen.exe 2528 pen.exe 2528 pen.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pen.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vicity = "c:\\Program Files\\bkqcr\\pen.exe \"c:\\Program Files\\bkqcr\\penao.dll\",Group" pen.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
pen.exedescription ioc process File opened (read-only) \??\u: pen.exe File opened (read-only) \??\a: pen.exe File opened (read-only) \??\e: pen.exe File opened (read-only) \??\h: pen.exe File opened (read-only) \??\j: pen.exe File opened (read-only) \??\n: pen.exe File opened (read-only) \??\r: pen.exe File opened (read-only) \??\t: pen.exe File opened (read-only) \??\y: pen.exe File opened (read-only) \??\k: pen.exe File opened (read-only) \??\l: pen.exe File opened (read-only) \??\m: pen.exe File opened (read-only) \??\o: pen.exe File opened (read-only) \??\q: pen.exe File opened (read-only) \??\g: pen.exe File opened (read-only) \??\p: pen.exe File opened (read-only) \??\s: pen.exe File opened (read-only) \??\x: pen.exe File opened (read-only) \??\b: pen.exe File opened (read-only) \??\i: pen.exe File opened (read-only) \??\v: pen.exe File opened (read-only) \??\w: pen.exe File opened (read-only) \??\z: pen.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
pen.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 pen.exe -
Drops file in Program Files directory 4 IoCs
Processes:
iamqo.exedescription ioc process File opened for modification \??\c:\Program Files\bkqcr iamqo.exe File created \??\c:\Program Files\bkqcr\penao.dll iamqo.exe File created \??\c:\Program Files\bkqcr\pen.exe iamqo.exe File opened for modification \??\c:\Program Files\bkqcr\pen.exe iamqo.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
pen.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 pen.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString pen.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pen.exepid process 2528 pen.exe 2528 pen.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pen.exedescription pid process Token: SeDebugPrivilege 2528 pen.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exeiamqo.exepid process 2956 c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe 2156 iamqo.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.execmd.exeiamqo.exedescription pid process target process PID 2956 wrote to memory of 2064 2956 c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe cmd.exe PID 2956 wrote to memory of 2064 2956 c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe cmd.exe PID 2956 wrote to memory of 2064 2956 c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe cmd.exe PID 2956 wrote to memory of 2064 2956 c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe cmd.exe PID 2064 wrote to memory of 3056 2064 cmd.exe PING.EXE PID 2064 wrote to memory of 3056 2064 cmd.exe PING.EXE PID 2064 wrote to memory of 3056 2064 cmd.exe PING.EXE PID 2064 wrote to memory of 3056 2064 cmd.exe PING.EXE PID 2064 wrote to memory of 2156 2064 cmd.exe iamqo.exe PID 2064 wrote to memory of 2156 2064 cmd.exe iamqo.exe PID 2064 wrote to memory of 2156 2064 cmd.exe iamqo.exe PID 2064 wrote to memory of 2156 2064 cmd.exe iamqo.exe PID 2156 wrote to memory of 2528 2156 iamqo.exe pen.exe PID 2156 wrote to memory of 2528 2156 iamqo.exe pen.exe PID 2156 wrote to memory of 2528 2156 iamqo.exe pen.exe PID 2156 wrote to memory of 2528 2156 iamqo.exe pen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe"C:\Users\Admin\AppData\Local\Temp\c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\iamqo.exe "C:\Users\Admin\AppData\Local\Temp\c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\iamqo.exeC:\Users\Admin\AppData\Local\Temp\\iamqo.exe "C:\Users\Admin\AppData\Local\Temp\c63790aa506d9ce3119b82414a0b1afd1f8cfbc2887bbdf987dea1d19205f5b2.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\Program Files\bkqcr\pen.exe"c:\Program Files\bkqcr\pen.exe" "c:\Program Files\bkqcr\penao.dll",Group C:\Users\Admin\AppData\Local\Temp\iamqo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\Program Files\bkqcr\penao.dllFilesize
148KB
MD508978c1b7c915768fdbe0f39fdcb01aa
SHA1b123b2bff91ff50f68c36992fbbc765a78b13004
SHA25687424b626bc0e4ffbfaa904db6bbc378eee18f5f4331178d1fdcaddb73414871
SHA5123cf2aeac77cc46dad762df15c8e559541cb4e1bcdd2ed2290816fbcdc4c0f58bc9a833b8e20a286506018477928f554d24942c1b279ee1e02c7b9694ac975ca3
-
\Program Files\bkqcr\pen.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
\Users\Admin\AppData\Local\Temp\iamqo.exeFilesize
210KB
MD513103a8b43adfcb57ccbb9555515e1b6
SHA11b614a2538339c240e038d1b47a6722d2deecac2
SHA256f274acc21c07d9997d3b8ef2dec88dbf76d654ec52151ae34c93a5291b33a1a0
SHA51210f09a6c786e6ee9531e843c703cbc6ce3587e1a2cc51d6a8e6c4dee07c5c747f1b0c288613326058dbe4b67ea1e36989c5c8c7f30490116760286d802626405
-
memory/2064-5-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2064-7-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2156-9-0x0000000000400000-0x0000000000479D2E-memory.dmpFilesize
487KB
-
memory/2156-15-0x0000000000400000-0x0000000000479D2E-memory.dmpFilesize
487KB
-
memory/2528-22-0x0000000010000000-0x0000000010054000-memory.dmpFilesize
336KB
-
memory/2528-24-0x0000000010000000-0x0000000010054000-memory.dmpFilesize
336KB
-
memory/2528-25-0x0000000010000000-0x0000000010054000-memory.dmpFilesize
336KB
-
memory/2528-27-0x0000000010000000-0x0000000010054000-memory.dmpFilesize
336KB
-
memory/2528-29-0x0000000010000000-0x0000000010054000-memory.dmpFilesize
336KB
-
memory/2956-0-0x0000000000400000-0x0000000000479D2E-memory.dmpFilesize
487KB
-
memory/2956-2-0x0000000000400000-0x0000000000479D2E-memory.dmpFilesize
487KB