Overview

overview

8

Static

static

3

2182d64d0b...18.exe

windows7-x64

8

2182d64d0b...18.exe

windows10-2004-x64

8

$_2_/Ad.exe

windows7-x64

1

$_2_/Ad.exe

windows10-2004-x64

1

$_2_/Downl...PS.dll

windows7-x64

1

$_2_/Downl...PS.dll

windows10-2004-x64

1

$_2_/QQVip...er.exe

windows7-x64

8

$_2_/QQVip...er.exe

windows10-2004-x64

8

$_2_/TXSSOSetup.exe

windows7-x64

7

$_2_/TXSSOSetup.exe

windows10-2004-x64

7

$_2_/Tencentdl.exe

windows7-x64

1

$_2_/Tencentdl.exe

windows10-2004-x64

1

$_2_/bugreport.exe

windows7-x64

1

$_2_/bugreport.exe

windows10-2004-x64

$_2_/curllib.dll

windows7-x64

3

$_2_/curllib.dll

windows10-2004-x64

3

$_2_/dlcore.dll

windows7-x64

1

$_2_/dlcore.dll

windows10-2004-x64

1

$_2_/extract.dll

windows7-x64

1

$_2_/extract.dll

windows10-2004-x64

1

$_2_/tinyxml.dll

windows7-x64

3

$_2_/tinyxml.dll

windows10-2004-x64

3

$_2_/tnproxy.dll

windows7-x64

1

$_2_/tnproxy.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 20:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $_2_/QQVipDownloader.exe
  • Size 1023KB
  • Sample240507-yrfqdsfg63
  • SHA256 e997d69e9649210f79167f2a8501196ac2a62a23944b5d0d39b1e9bd7e3b774f
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitevasionpersistence

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$_2_\QQVipDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\$_2_\QQVipDownloader.exe"
    1⤵
    • Checks computer location settings
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\appdata\local\temp\$_2_\tencentdl.exe
      "C:\Users\Admin\appdata\local\temp\$_2_\tencentdl.exe" /install
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe
        "C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" /RegServer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\tencentdl.exe" action=allow
          4⤵
          • Modifies Windows Firewall
          PID:2448
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="腾讯产品下载组件Crash上报" dir=in program="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" description="C:\program files (x86)\common files\tencent\qqdownload\127\bugreport_xf.exe" action=allow
          4⤵
          • Modifies Windows Firewall
          PID:1128
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\program files (x86)\common files\tencent\qqdownload\127\DownloadProxyPS.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1152

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DownloadProxyPS.dll
        • Path C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\DownloadProxyPS.dll
        • Size 67KB
        • SHA256 1ce25ffc0d8671f5c44573ec190533860cc3bec823d2dcfaf4548a0bd76add50
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstallInfo.xml
        • Path C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\InstallInfo.xml
        • Size 1KB
        • SHA256 bb0e39703757359fed8c7531935f556b5c659870365380e045509303f10bded0
        • MD5 SHA1 SHA512
        Submit Download

        Tencentdl.exe
        • Path C:\Program Files (x86)\Common Files\Tencent\QQDownload\127\Tencentdl.exe
        • Size 915KB
        • SHA256 fcaf44a74ec98e9780ddded45729dab1dc292c3a1bfed1c1a7ce56f1fed9b604
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dlcore.dll
        • Path \??\c:\program files (x86)\common files\tencent\qqdownload\127\dlcore.dll
        • Size 1.9MB
        • SHA256 ad1425b8497cf8b5891adbd51371c3ceb0f977e6e417b6c3f3262e6b6f01e2fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        extract.dll
        • Path \??\c:\program files (x86)\common files\tencent\qqdownload\127\extract.dll
        • Size 358KB
        • SHA256 f2181e41d5950fcb762edf6b9cbb665e94004a7f1102b606c331690e6069a501
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tnproxy.dll
        • Path \??\c:\program files (x86)\common files\tencent\qqdownload\127\tnproxy.dll
        • Size 707KB
        • SHA256 26c906e83d280f03e021a5730908cc40551f8ef98e048b9ae001354ec83ae736
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download