d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f

General

Target

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
Size

124KB
MD5

d17bc0b43b8008372784207164994b35
SHA1

dcf4b2fc8267c84e06ef6ca58701704acdde899a
SHA256

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f
SHA512

264bb74a93593d9a883935a1afc995db7803e78dcf0912f93e4a657ffe07ab036b7f4f721bede493a4295d058ae10016ba82ae6427fb936f086bdf000519b0a1
SSDEEP

1536:tnQ8p/DDBeZUBFTgVjtXZTto1e9uCLBCPr8/NL44PerV5I8kIi/2O:Nbp/ReZU7TgdTq1ZrJO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeivie.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qeivie.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe

Executes dropped EXE 1 IoCs

Processes:

qeivie.exe

pid process

3952 qeivie.exe

pid	process
3952	qeivie.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

qeivie.exed4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /s"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /u"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /t"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /v"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /i"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /d"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /r"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /k"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /a"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /m"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /c"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /x"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /l"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /p"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /z"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /f"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /g"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /g"	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /b"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /w"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /y"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /h"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /e"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /o"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /j"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /n"	qeivie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeivie = "C:\\Users\\Admin\\qeivie.exe /q"	qeivie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeivie.exe

pid	process
2752	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
2752	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe
3952	qeivie.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exeqeivie.exe

pid process

2752 d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
3952 qeivie.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe

description	pid	process	target process
PID 2752 wrote to memory of 3952	2752	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe	qeivie.exe
PID 2752 wrote to memory of 3952	2752	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe	qeivie.exe
PID 2752 wrote to memory of 3952	2752	d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe	qeivie.exe

C:\Users\Admin\AppData\Local\Temp\d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe
"C:\Users\Admin\AppData\Local\Temp\d4dae273dcd4591e051d028b3705da5c19eba0bf21a21fb92430b9248e43de2f.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\qeivie.exe
"C:\Users\Admin\qeivie.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\qeivie.exe

Filesize
124KB

MD5
3325d3da30a43946f61ffe64a15b3603

SHA1
7124eadb5ddc38c5bcdb5d6c0845104599bf8e7e

SHA256
dd918d56c9196f5cd742c0b4a259d414bf0442d29880533bd074d04a37015a29

SHA512
ff51f973b1388ad4baec6cd95653a7296f236fc11df6332e24b0f6c0757beabd6976ecf926d8e5d20a3987bdb8a797b2b2298cc92801b24b2e0353886f202ba0

Download Submit
memory/2752-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3952-22-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads