65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015

General

Target

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Size

104KB
MD5

04f11f645c82ce66ef89bbc8cd14dbd4
SHA1

52cddf036fe902f7dc31ba9faf71f76de236dd04
SHA256

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015
SHA512

1c2c831bf645377f60160e85570d0ff448c70a26f43380a6778fc355dc68a4a3786288ccc5a164e0eb7620cfb565cf2737402a75cab50d3255e8bc6fa3837006
SSDEEP

1536:PSSSOiNqnTeh6hC8bwT+lyHcw1vjzVj+xakAyBGIs7oJd:KlkTehGwT+lyHB5XN+x9s7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeqioqe.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qioqe.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

Executes dropped EXE 1 IoCs

Processes:

qioqe.exe

pid process

1752 qioqe.exe

pid	process
1752	qioqe.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

qioqe.exe65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /r"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /c"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /z"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /n"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /p"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /j"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /o"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /a"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /l"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /v"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /w"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /x"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /i"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /e"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /h"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /d"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /t"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /f"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /u"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /q"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /g"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /m"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /y"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /s"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /r"	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /b"	qioqe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qioqe = "C:\\Users\\Admin\\qioqe.exe /k"	qioqe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeqioqe.exe

pid	process
844	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
844	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe
1752	qioqe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exeqioqe.exe

pid process

844 65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
1752 qioqe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe

description	pid	process	target process
PID 844 wrote to memory of 1752	844	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	qioqe.exe
PID 844 wrote to memory of 1752	844	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	qioqe.exe
PID 844 wrote to memory of 1752	844	65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe	qioqe.exe

C:\Users\Admin\AppData\Local\Temp\65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe
"C:\Users\Admin\AppData\Local\Temp\65857d9171c7271d98118cf8cc9383fe7f098c66935fe9b8a77128d5921c2015.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\qioqe.exe
"C:\Users\Admin\qioqe.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\qioqe.exe

Filesize
104KB

MD5
8368477ac50d79a519f4c3afedd5cf6b

SHA1
80731a5d2919f5eab6a4a6d0fee563c4bb11ed40

SHA256
886637b14c0cc6631ab8facb9fb6f03f705929a5ead75f8247cb44487284aae3

SHA512
1993c363870f9978bdf22b50f06e24988947d6ab964df12db327042f7eb637d3d209c4f9858612d4ae8f8cbe36d8afe9aa1d5bcf51769c8aa46c09421f3358f1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads