Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 08:29
Static task
static1
Behavioral task
behavioral1
Sample
53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe
Resource
win10v2004-20240412-en
General
-
Target
53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe
-
Size
497KB
-
MD5
dedd4ef7176809952c6b5b2492d4a972
-
SHA1
770537e96bfbe3e2dc352af8dfe6edb8a8c971bd
-
SHA256
53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e
-
SHA512
189ff05c388569af1ea5f871a16ef8fdb332a1c5f04c04b2e8079560ea195fa61ec25f85bb4f793c7d89f0acdee54f77531ff02acaf728b6677e00a0fcbfbd41
-
SSDEEP
12288:coIUKt8Ot1lyFLHoOPBvORzF38IjI1GCL7YdnLZjQ/4:coU8Ot1lyFLHoOxR0I1GGYdLZjy4
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4548-114-0x0000000000E10000-0x0000000000ED6000-memory.dmp family_sectoprat -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
u3t0.0.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exepid process 3960 u3t0.0.exe 2836 Qg_Appv5.exe 5096 UniversalInstaller.exe 3396 UniversalInstaller.exe -
Loads dropped DLL 4 IoCs
Processes:
UniversalInstaller.exeUniversalInstaller.exepid process 5096 UniversalInstaller.exe 5096 UniversalInstaller.exe 3396 UniversalInstaller.exe 3396 UniversalInstaller.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
UniversalInstaller.execmd.exedescription pid process target process PID 3396 set thread context of 4640 3396 UniversalInstaller.exe cmd.exe PID 4640 set thread context of 4548 4640 cmd.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\GS_Debug.job cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3012 3960 WerFault.exe u3t0.0.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exepid process 2836 Qg_Appv5.exe 2836 Qg_Appv5.exe 2836 Qg_Appv5.exe 2836 Qg_Appv5.exe 5096 UniversalInstaller.exe 3396 UniversalInstaller.exe 3396 UniversalInstaller.exe 4640 cmd.exe 4640 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
UniversalInstaller.execmd.exepid process 3396 UniversalInstaller.exe 4640 cmd.exe 4640 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4548 MSBuild.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exepid process 2836 Qg_Appv5.exe 5096 UniversalInstaller.exe 5096 UniversalInstaller.exe 3396 UniversalInstaller.exe 3396 UniversalInstaller.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exedescription pid process target process PID 4932 wrote to memory of 3960 4932 53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe u3t0.0.exe PID 4932 wrote to memory of 3960 4932 53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe u3t0.0.exe PID 4932 wrote to memory of 3960 4932 53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe u3t0.0.exe PID 4932 wrote to memory of 2836 4932 53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe Qg_Appv5.exe PID 4932 wrote to memory of 2836 4932 53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe Qg_Appv5.exe PID 2836 wrote to memory of 5096 2836 Qg_Appv5.exe UniversalInstaller.exe PID 2836 wrote to memory of 5096 2836 Qg_Appv5.exe UniversalInstaller.exe PID 2836 wrote to memory of 5096 2836 Qg_Appv5.exe UniversalInstaller.exe PID 5096 wrote to memory of 3396 5096 UniversalInstaller.exe UniversalInstaller.exe PID 5096 wrote to memory of 3396 5096 UniversalInstaller.exe UniversalInstaller.exe PID 5096 wrote to memory of 3396 5096 UniversalInstaller.exe UniversalInstaller.exe PID 3396 wrote to memory of 4640 3396 UniversalInstaller.exe cmd.exe PID 3396 wrote to memory of 4640 3396 UniversalInstaller.exe cmd.exe PID 3396 wrote to memory of 4640 3396 UniversalInstaller.exe cmd.exe PID 3396 wrote to memory of 4640 3396 UniversalInstaller.exe cmd.exe PID 4640 wrote to memory of 4548 4640 cmd.exe MSBuild.exe PID 4640 wrote to memory of 4548 4640 cmd.exe MSBuild.exe PID 4640 wrote to memory of 4548 4640 cmd.exe MSBuild.exe PID 4640 wrote to memory of 4548 4640 cmd.exe MSBuild.exe PID 4640 wrote to memory of 4548 4640 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe"C:\Users\Admin\AppData\Local\Temp\53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3t0.0.exe"C:\Users\Admin\AppData\Local\Temp\u3t0.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 12363⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3960 -ip 39601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240420083111.TXTFilesize
455B
MD54acf240e1985b7d5f026224c54ae5d1a
SHA11960e8b2b1b246d01d44af3b8bd6f38cff76ef13
SHA256a39ca71173f948a7e288823e4c9b5d8a99bcd3c1da19836c76211c472e09c260
SHA5126acba40e21d2fb93ea4ff029442f0143abed6e797ebea358983ba7e9125ce01496e49446e47ff8c7fdca9851009cc6c1f7c7e8b5b677d761db69da286f7b5804
-
C:\Users\Admin\AppData\Local\Temp\4421598aFilesize
5.9MB
MD5dcc26dd014bad9eafa9066d3781b615d
SHA1b0cb8621ca58a196ac73bed4e525deacfaf2d836
SHA25669502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3
SHA5125a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3
-
C:\Users\Admin\AppData\Local\Temp\519bed1cFilesize
1.4MB
MD5a26ad5b4f7acf015c57c73716d896f7c
SHA1a2572ab04e5eef8379b046f65cef1477a70c1e22
SHA2568c457eaf084e6c485e067fca339c9912ceebcc11ca765be97a60ef7762a2a60d
SHA5120da3811f324f6d7496fa3a95ca27bb61b6b9fc820a2182df4b9c77e237452f9bf035cd0e29b4470590dbe42ca780c69e27d3f37c4db42909ce6c15d7991b8f1c
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.7MB
MD56955715b6ff15bdc153a2431cc395cca
SHA1272e1eec66a1871b300484b2200b507a4abe5420
SHA256a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761
SHA512cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dllFilesize
1.6MB
MD58f75e17a8bf3de6e22e77b5586f8a869
SHA1e0bf196cfc19a8772e003b9058bdc211b419b261
SHA2565f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985
SHA5125a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dllFilesize
1.5MB
MD57d2f87123e63950159fb2c724e55bdab
SHA1360f304a6311080e1fead8591cb4659a8d135f2d
SHA256b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a
SHA5126cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtfFilesize
24KB
MD5ff36ebcf134c8846aea77446867e5bc6
SHA153fdf2c0bec711e377edb4f97cd147728fb568f6
SHA256e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9
SHA512b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xmlFilesize
1.3MB
MD52d8de35aa00138b2bfc4fb0fc3d0f58b
SHA128c2d84e01815702c230da456aaa17c7d2519186
SHA25619340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac
SHA512378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128
-
C:\Users\Admin\AppData\Local\Temp\u3t0.0.exeFilesize
353KB
MD531cb8ff276a0a394c3572a942fb623c3
SHA1e64b3f111a0cd572b201ecac2b3cab849b854a06
SHA256e80bfaa0b68c7040402915f2d057e7114f0a0b16ca3e36dcd937bf19341347e8
SHA512cd864f77c63943836a34e6daa52c4cc65bbd6c8bf064c841598dd12f48b65a0182ce8147ebd38f5aaf25196889b1e8d23a3c73fb9d4493a95199940f9786f1be
-
memory/2836-44-0x0000000000E10000-0x0000000001CED000-memory.dmpFilesize
14.9MB
-
memory/2836-54-0x00007FFB99BC0000-0x00007FFB99D3A000-memory.dmpFilesize
1.5MB
-
memory/2836-63-0x00007FFB99BC0000-0x00007FFB99D3A000-memory.dmpFilesize
1.5MB
-
memory/2836-52-0x00007FFB99BC0000-0x00007FFB99D3A000-memory.dmpFilesize
1.5MB
-
memory/2836-50-0x000001FFDDD30000-0x000001FFDDD31000-memory.dmpFilesize
4KB
-
memory/2836-93-0x00007FFB99BC0000-0x00007FFB99D3A000-memory.dmpFilesize
1.5MB
-
memory/3396-90-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/3396-91-0x00007FFBA9600000-0x00007FFBA9809000-memory.dmpFilesize
2.0MB
-
memory/3396-92-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/3396-95-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/3960-19-0x0000000000400000-0x0000000001A22000-memory.dmpFilesize
22.1MB
-
memory/3960-18-0x0000000000400000-0x0000000001A22000-memory.dmpFilesize
22.1MB
-
memory/3960-17-0x0000000001B50000-0x0000000001B77000-memory.dmpFilesize
156KB
-
memory/3960-16-0x0000000001B80000-0x0000000001C80000-memory.dmpFilesize
1024KB
-
memory/4548-120-0x0000000005680000-0x00000000056D0000-memory.dmpFilesize
320KB
-
memory/4548-114-0x0000000000E10000-0x0000000000ED6000-memory.dmpFilesize
792KB
-
memory/4548-116-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/4548-117-0x0000000005BD0000-0x0000000006176000-memory.dmpFilesize
5.6MB
-
memory/4548-118-0x0000000005720000-0x0000000005730000-memory.dmpFilesize
64KB
-
memory/4548-119-0x0000000005900000-0x0000000005AC2000-memory.dmpFilesize
1.8MB
-
memory/4548-111-0x0000000071550000-0x0000000072867000-memory.dmpFilesize
19.1MB
-
memory/4548-121-0x00000000057B0000-0x0000000005826000-memory.dmpFilesize
472KB
-
memory/4548-122-0x00000000067B0000-0x0000000006CDC000-memory.dmpFilesize
5.2MB
-
memory/4548-115-0x0000000073250000-0x0000000073A01000-memory.dmpFilesize
7.7MB
-
memory/4640-102-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/4640-97-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/4640-101-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/4640-107-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/4640-109-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB
-
memory/4640-100-0x00007FFBA9600000-0x00007FFBA9809000-memory.dmpFilesize
2.0MB
-
memory/4932-22-0x0000000001DA0000-0x0000000001EA0000-memory.dmpFilesize
1024KB
-
memory/4932-45-0x0000000000400000-0x0000000001A47000-memory.dmpFilesize
22.3MB
-
memory/4932-1-0x0000000001DA0000-0x0000000001EA0000-memory.dmpFilesize
1024KB
-
memory/4932-21-0x00000000038C0000-0x000000000392E000-memory.dmpFilesize
440KB
-
memory/4932-20-0x0000000000400000-0x0000000001A47000-memory.dmpFilesize
22.3MB
-
memory/4932-3-0x0000000000400000-0x0000000001A47000-memory.dmpFilesize
22.3MB
-
memory/4932-2-0x00000000038C0000-0x000000000392E000-memory.dmpFilesize
440KB
-
memory/5096-74-0x00007FFBA9600000-0x00007FFBA9809000-memory.dmpFilesize
2.0MB
-
memory/5096-73-0x0000000072A80000-0x0000000072BFD000-memory.dmpFilesize
1.5MB