4a7150ab535c7ea3de1366603f913cd42e85fb790ed7d74a7586cbf186c3baa1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Quantum loader/Quantum-Loader.exe
Size

15.5MB
MD5

81bbc72fad32d1171c49dae0d88f309a
SHA1

b6060ea112ffacdb7deb316dfda26a913ffae6d1
SHA256

8f1fb252d143dc714304a473a0b8ae7bef2088bc58e57bf9843ec8a1a0f5d4aa
SHA512

7f817cad2511886a96522edd7589eb9daf37a4bc2fddf07f8c8d2e8f47ec73bde1babec48946d01b79fbfe8aaf28c04ae6fd350267f37328ef94fe13d8c1f5e7
SSDEEP

393216:sOVPbsmX4w1v64dP0qZ0sRh5D+IJMdlxkUVNCyc9yyv:sOVPVXD66P0jsRhZJcxc9j

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2984	Quantum-Loader.exe

Loads dropped DLL 2 IoCs

pid	Process
2160	Quantum-Loader.exe
2984	Quantum-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2984	2160	Quantum-Loader.exe	28
PID 2160 wrote to memory of 2984	2160	Quantum-Loader.exe	28
PID 2160 wrote to memory of 2984	2160	Quantum-Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\Quantum loader\Quantum-Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Quantum loader\Quantum-Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\onefile_2160_133606277845422000\Quantum-Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Quantum loader\Quantum-Loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2160_133606277845422000\python311.dll

Filesize
5.5MB

MD5
d06da79bfd21bb355dc3e20e17d3776c

SHA1
610712e77f80d2507ffe85129bfeb1ff72fa38bf

SHA256
2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1

SHA512
e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2160_133606277845422000\Quantum-Loader.exe

Filesize
29.5MB

MD5
27617f35e4c21eaa120a02e1d154ad35

SHA1
7bd033eb8bfea9e0c4fd15e15ff5237d12a869be

SHA256
120d5b9bdf1dfa1c6388ffcb3e1f6eefa6570eca2ca4066643abacea0b4d3005

SHA512
42cd6594641ea7a47881502098b09e8b012fcfcf03fdad991696a25b4316d901496d0bb760fc92068e8387b1a0daa676bec831f97a29b73425a2d913c5b41b82

Download Submit
memory/2160-127-0x000000013FED0000-0x0000000140E5C000-memory.dmp

Filesize
15.5MB

Download
memory/2984-66-0x000000013F350000-0x0000000141146000-memory.dmp

Filesize
30.0MB

Download