Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
12/05/2024, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe
- Size 405KB
- Sample240512-dry7hsgh68
- SHA256 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e
- MD5 2cfe44c8526b0e7a70ff36b003cff280
- SHA1 f44678e9c0b25a97e7da552218f2763b84139c38
- SHA512 7b5f3c9b0468baa06c47dccc525aab228b1cffd2718b2d6a9f424d53d7dc271d08a6c12d61bf256f98aaed0882e6be4e3d53ef907dd772613ca93355ad798620
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 9 IoCs
flow pid Process 36 3132 rundll32.exe 43 3132 rundll32.exe 44 3132 rundll32.exe 45 3132 rundll32.exe 59 3132 rundll32.exe 60 3132 rundll32.exe 66 3132 rundll32.exe 74 3132 rundll32.exe 75 3132 rundll32.exe - Deletes itself 1 IoCs
pid Process 2096 vixkp.exe - Executes dropped EXE 1 IoCs
pid Process 2096 vixkp.exe - Loads dropped DLL 1 IoCs
pid Process 3132 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\qzzupia\\dicuti.dll\",Verify" rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\e: rundll32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3132 rundll32.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\qzzupia vixkp.exe File created \??\c:\Program Files\qzzupia\dicuti.dll vixkp.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3084 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe 3132 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3132 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2744 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe 2096 vixkp.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2744 wrote to memory of 3760 2744 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe 83 PID 2744 wrote to memory of 3760 2744 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe 83 PID 2744 wrote to memory of 3760 2744 938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe 83 PID 3760 wrote to memory of 3084 3760 cmd.exe 85 PID 3760 wrote to memory of 3084 3760 cmd.exe 85 PID 3760 wrote to memory of 3084 3760 cmd.exe 85 PID 3760 wrote to memory of 2096 3760 cmd.exe 88 PID 3760 wrote to memory of 2096 3760 cmd.exe 88 PID 3760 wrote to memory of 2096 3760 cmd.exe 88 PID 2096 wrote to memory of 3132 2096 vixkp.exe 90 PID 2096 wrote to memory of 3132 2096 vixkp.exe 90 PID 2096 wrote to memory of 3132 2096 vixkp.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe"C:\Users\Admin\AppData\Local\Temp\938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\vixkp.exe "C:\Users\Admin\AppData\Local\Temp\938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\vixkp.exeC:\Users\Admin\AppData\Local\Temp\\vixkp.exe "C:\Users\Admin\AppData\Local\Temp\938df88200f6a56925c3bc0a3a20c8aefcbc2eb33eba1d0548117233cf21651e.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\qzzupia\dicuti.dll",Verify C:\Users\Admin\AppData\Local\Temp\vixkp.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\vixkp.exe
- Size 406KB
- SHA256 f96554bc09905677234721628cfaa9258f8abc5dcfe1767ece729edc6578aea5
- MD5 0d09d4bb000a34b38a323f5bff9c13f2
- SHA1 3e05ec052f291471a86cbebb60a86e4fe5c57aa0
- SHA512 b3bd58b2ab906bb669a9c4081c9b7dc1c6d8f35f15351656c3261ec889083a553ef79664f105921be529f9f77e205f18172848be97961da41f8a481221755b1d
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4s:gtRfJcNYFNm8UhlZGses
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Program Files\qzzupia\dicuti.dll
- Size 228KB
- SHA256 c7ece8c0c8715774e03b27c5665f49e2e1f1163d2d9e58bcf56a0225eff87245
- MD5 71bc5872a7873391c0b1fb2d177165dc
- SHA1 ee2035c8aba745f2c24b76e134c90572defe54c9
- SHA512 96d45c0ff043117da3dd5039a7f24ac60383d77024e78564c6edfd6c2d66b3e8c14f1a58105fdd056abde4bcf31ece1105e22e5fa733abaaedb12cf21d4169e8
- SSDEEP 6144:U1oEITTl5VCuHFrEy0wEOR7ndfAnVxERZ4CR3XaNa:5vVrHFrL05gdonVANpj
- MD5 SHA1 SHA512 SSDEEP