Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 03:48
Static task
static1
Behavioral task
behavioral1
Sample
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
Resource
win10v2004-20240412-en
General
-
Target
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
-
Size
124KB
-
MD5
d17bc0b43b8008372784207164994b35
-
SHA1
dcf4b2fc8267c84e06ef6ca58701704acdde899a
-
SHA256
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f
-
SHA512
264bb74a93593d9a883935a1afc995db7803e78dcf0912f93e4a657ffe07ab036b7f4f721bede493a4295d058ae10016ba82ae6427fb936f086bdf000519b0a1
-
SSDEEP
1536:tnQ8p/DDBeZUBFTgVjtXZTto1e9uCLBCPr8/NL44PerV5I8kIi/2O:Nbp/ReZU7TgdTq1ZrJO
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeiojis.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeiojis.exe -
Executes dropped EXE 1 IoCs
Processes:
qeiojis.exepid process 2080 qeiojis.exe -
Loads dropped DLL 2 IoCs
Processes:
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exepid process 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe -
Adds Run key to start application 2 TTPs 27 IoCs
Processes:
qeiojis.exed4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /y" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /f" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /w" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /b" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /t" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /r" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /f" d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /i" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /l" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /q" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /m" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /z" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /d" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /x" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /n" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /h" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /o" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /e" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /j" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /u" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /v" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /g" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /k" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /s" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /a" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /c" qeiojis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiojis = "C:\\Users\\Admin\\qeiojis.exe /p" qeiojis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeiojis.exepid process 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe 2080 qeiojis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeiojis.exepid process 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe 2080 qeiojis.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exedescription pid process target process PID 2744 wrote to memory of 2080 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe qeiojis.exe PID 2744 wrote to memory of 2080 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe qeiojis.exe PID 2744 wrote to memory of 2080 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe qeiojis.exe PID 2744 wrote to memory of 2080 2744 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe qeiojis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe"C:\Users\Admin\AppData\Local\Temp\d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\qeiojis.exe"C:\Users\Admin\qeiojis.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\qeiojis.exeFilesize
124KB
MD575cd105ef5c0b7f0151126461fef624e
SHA117bfaf1f6d81f7be99560c2a7e724f8c4d2ea54c
SHA256438880f12a4e34171089db19949f8e1b1d5249f69fb3ccd2c01769c5953a6eca
SHA512952a6abe923d1f1630f3b347c6616b0049ee2323235a80e9239e7e1c776da811c3ae63b558123bd2e2da3edf728437e009dfc72bbc4cb352ce731c0eb4a31638
-
memory/2080-18-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2744-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2744-15-0x00000000031D0000-0x00000000031EF000-memory.dmpFilesize
124KB
-
memory/2744-17-0x00000000031D0000-0x00000000031EF000-memory.dmpFilesize
124KB