Overview

overview

3

Static

static

3

ForceCPU.exe

windows7-x64

1

ForceCPU.exe

windows10-2004-x64

1

HTCTL32.dll

windows7-x64

3

HTCTL32.dll

windows10-2004-x64

3

PCICHEK.dll

windows7-x64

1

PCICHEK.dll

windows10-2004-x64

1

PCICL32.dll

windows7-x64

1

PCICL32.dll

windows10-2004-x64

1

QWhale.Common.dll

windows7-x64

1

QWhale.Common.dll

windows10-2004-x64

1

QWhale.Editor.dll

windows7-x64

1

QWhale.Editor.dll

windows10-2004-x64

1

QWhale.Syntax.dll

windows7-x64

1

QWhale.Syntax.dll

windows10-2004-x64

1

Qt5QmlModels.dll

windows7-x64

1

Qt5QmlModels.dll

windows10-2004-x64

1

Qt5QuickWidgets.dll

windows7-x64

1

Qt5QuickWidgets.dll

windows10-2004-x64

1

Qt5SerialPort.dll

windows7-x64

1

Qt5SerialPort.dll

windows10-2004-x64

1

SimpleFilter.dll

windows7-x64

1

SimpleFilter.dll

windows10-2004-x64

1

TCCTL32.dll

windows7-x64

1

TCCTL32.dll

windows10-2004-x64

1

Timeline.dll

windows7-x64

1

Timeline.dll

windows10-2004-x64

1

api-ms-win...-0.dll

windows10-2004-x64

1

audio/SampleRules.js

windows7-x64

3

audio/SampleRules.js

windows10-2004-x64

3

avcodec-58.dll

windows7-x64

1

avcodec-58.dll

windows10-2004-x64

3

avformat-58.dll

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d8e2f68ce537be331fb8776d6d2e118da87bb31fd7f266392d382f92dc5193d.zip

  • Size

    6.9MB

  • Sample

    240523-bf1j4aga76

  • MD5

    638228dc9045ab310cafb231fccaea1d

  • SHA1

    2629e42151dce0939f59a131c54abf3a7fc8ce9d

  • SHA256

    0d8e2f68ce537be331fb8776d6d2e118da87bb31fd7f266392d382f92dc5193d

  • SHA512

    0709619167ce857738730047761181f5b9af458189d61073f2aa8ecadf841fda950202db8bbdeee9bd0eef2b893e82468c996bfb186ec74b3965e9e8ee67926f

  • SSDEEP

    196608:MxYoY59V0redpmQRyq7cLCueSB4lE71V/YxQtw44B2yZIgrh0:eYvGqdpmYK+SWW2Otw4hyuWh0

Score
3/10
execution

Malware Config

Targets

    • Target

      ForceCPU.exe

    • Size

      19KB

    • MD5

      b982a103b0d4e0db856026a163124bf3

    • SHA1

      40772be00068bbd394ff0fccd551151a822f3e70

    • SHA256

      2d209c2b823e350c1f1661f87a3a013804302477afe56877f94adbafe7a2e06d

    • SHA512

      214ecdf348e2093e91a489c0541f05eb3356e2531c1840a99d9f727caf1130f5041ccbc6356a7bc31fb4dece927d3fee2fa9e4689d2badbe680fd40104a9d327

    • SSDEEP

      192:fHtIemmfltxD5WLtWwiyT5hNGnYe+PjPxucwwyibSucwwQJk35H0JOqxEV1a//bG:xD5WLZ5qnYPLxoDfoDg+JNY1cAhhv

    Score
    1/10
    behavioral1behavioral2

    • Target

      HTCTL32.DLL

    • Size

      320KB

    • MD5

      c94005d2dcd2a54e40510344e0bb9435

    • SHA1

      55b4a1620c5d0113811242c20bd9870a1e31d542

    • SHA256

      3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

    • SHA512

      2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

    • SSDEEP

      6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR

    Score
    3/10
    behavioral3behavioral4

    • Target

      PCICHEK.DLL

    • Size

      18KB

    • MD5

      104b30fef04433a2d2fd1d5f99f179fe

    • SHA1

      ecb08e224a2f2772d1e53675bedc4b2c50485a41

    • SHA256

      956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

    • SHA512

      5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

    • SSDEEP

      192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI

    Score
    1/10
    behavioral5behavioral6

    • Target

      PCICL32.DLL

    • Size

      3.6MB

    • MD5

      d3d39180e85700f72aaae25e40c125ff

    • SHA1

      f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

    • SHA256

      38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

    • SHA512

      471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

    • SSDEEP

      49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/

    Score
    1/10
    behavioral7behavioral8

    • Target

      QWhale.Common.dll

    • Size

      192KB

    • MD5

      ac80e3ca5ec3ed77ef7f1a5648fd605a

    • SHA1

      593077c0d921df0819d48b627d4a140967a6b9e0

    • SHA256

      93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

    • SHA512

      3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

    • SSDEEP

      1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc

    Score
    1/10
    behavioral10behavioral9

    • Target

      QWhale.Editor.dll

    • Size

      816KB

    • MD5

      eaa268802c633f27fcfc90fd0f986e10

    • SHA1

      21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

    • SHA256

      fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

    • SHA512

      c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

    • SSDEEP

      12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB

    Score
    1/10
    behavioral11behavioral12

    • Target

      QWhale.Syntax.dll

    • Size

      228KB

    • MD5

      3be64186e6e8ad19dc3559ee3c307070

    • SHA1

      2f9e70e04189f6c736a3b9d0642f46208c60380a

    • SHA256

      79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

    • SHA512

      7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

    • SSDEEP

      3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V

    Score
    1/10
    behavioral13behavioral14

    • Target

      Qt5QmlModels.dll

    • Size

      341KB

    • MD5

      78e8091feb2e6ce5646459db0ea9e465

    • SHA1

      1731d2d47cfe21394f208f7baff7ea1f2e702546

    • SHA256

      065c8d687dc74964123f4bb06319565b163b164ab09dadc1eb6929ee19755735

    • SHA512

      b3fdf745336c7473b9afa57432379ff32ca5105eb956779da16de3cd55453af54e1420e5f514a1bd9f78107dad4ef719089640cfd0f144d8b7a36e3e39e319d5

    • SSDEEP

      6144:hX6wb2uBTVgttAC/trZYzAZpebGUvteg0NYMr7XPqfQ3G/7fOTvFmqi9:3BVgXt9EAUGUQg/MfXQ0m/9

    Score
    1/10
    behavioral15behavioral16

    • Target

      Qt5QuickWidgets.dll

    • Size

      66KB

    • MD5

      0c1210b83e965e391ec725811f4c233f

    • SHA1

      156b414ee4d78df6efc37717434dd4428cc5f9d0

    • SHA256

      ee8ecdb086359fefc14f82cc2aac7b572a471264ff756e848615cafce72c98b0

    • SHA512

      b82e5f871cf4b57b7bfd34d6413b070adbb63872ef12e2a1bcede47a59721d210f843e2eb6d15ccfd66578bfb71afd1e57b61815a0951919245a5499066140df

    • SSDEEP

      1536:1b32hJ44pc5UJPkKRKQHiEPWuCivyMGIj/zRUCqr26dZUfS:1bm74SqdKRhHiOWuCUfGIzzRUCqr2qb

    Score
    1/10
    behavioral17behavioral18

    • Target

      Qt5SerialPort.dll

    • Size

      64KB

    • MD5

      76d5e06e7cd3dda770e73b311d908334

    • SHA1

      01fb750d2a7dc02baa8dc5189354325a9d17c131

    • SHA256

      de57f02ab8dee19889a13be9976e90ce0aa2f1b7db2e09d3608b465faabed167

    • SHA512

      547f550759caab21473d5e239629e00542094e3214c7a05ae5883071129670ce5535b35c81e9045dea72db8bbbb6fa3953039b3daaee4f2f922a68e3f7b864ac

    • SSDEEP

      768:tp8CUcv41KI1YRmTQTbjNuZOe/V9+A906sko7igZnU0Vkh2lWkPiyk38h2psG/pH:Eyv4GR5DOy7iSf+hG1ZX7Wjl5VUUfaM

    Score
    1/10
    behavioral19behavioral20

    • Target

      SimpleFilter.dll

    • Size

      147KB

    • MD5

      90cdc635a1f1f8e6e1ee68918e0fb71a

    • SHA1

      65699920fc6fc9488c1eb8acaf5022eaeafb6815

    • SHA256

      afee7df6255757b3251721fca42e844753a617e0aa1ed43734e32e2fdae2c0af

    • SHA512

      720635e0e24ca06b3c400f6da201f08d174e5bef230037eeae023ca87f608b1c353ca58de1a5c99a5f3057b039704ed5e68a9e5448183527653afcaedcfc58ab

    • SSDEEP

      3072:e6NX70tFXM29SwIEV21p/r+Q7NNi+NQmDdj7RMttBaOrMzz27CDHqyoqKIh4bqG8:e6NXwM29SwIEV21p/r+Q7NNi+NQmDdjj

    Score
    1/10
    behavioral21behavioral22

    • Target

      TCCTL32.DLL

    • Size

      387KB

    • MD5

      eab603d12705752e3d268d86dff74ed4

    • SHA1

      01873977c871d3346d795cf7e3888685de9f0b16

    • SHA256

      6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea

    • SHA512

      77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3

    • SSDEEP

      12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ

    Score
    1/10
    behavioral23behavioral24

    • Target

      Timeline.dll

    • Size

      51KB

    • MD5

      ec476c3ee3f7d463fc8b71a8da42e103

    • SHA1

      a32e85e618a4451feefed350f7fdb88dc662833d

    • SHA256

      25e20d696fa2d40cab80d6e45e998f63ef17564b4bacd978d98dbf4492be93ee

    • SHA512

      ec3c77cb84667aea1330dbeb9e5756a37f55570e4edc1bdde9c873e9218cfed6da2c0df57f4f3f9c2864cb664d1eb55700c95a1555d4bc5d485f0fc028c02c3b

    • SSDEEP

      768:BE8uqoL19VqLPLyYhH9L52OBRz6e4NPTijqhRR2fTMR2fT8BN266bC:YVqLPLyYhFcGzyijLx26O

    Score
    1/10
    behavioral25behavioral26

    • Target

      api-ms-win-crt-runtime-l1-1-0.dll

    • Size

      22KB

    • MD5

      ae3fa6bf777b0429b825fb6b028f8a48

    • SHA1

      b53dbfdb7c8deaa9a05381f5ac2e596830039838

    • SHA256

      66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb

    • SHA512

      1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece

    • SSDEEP

      384:5b7hrKIW2hW6SUA0GftpBjoQt1TlI663UMp:5bNrKcziZzW66kMp

    Score
    1/10
    behavioral27

    • Target

      audio/SampleRules.js

    • Size

      22KB

    • MD5

      524d2bade9189baf1556a19a646cf4bf

    • SHA1

      66c1eff782d71d0a5cc8e370958137a9acd852e4

    • SHA256

      3d4de2f5b6be253ffe40b04e90b6fe80eb1025f97975b820683e679c55f5b3c8

    • SHA512

      36f1a2b9728e89b640fe5a5ee7cde1cdaacb6ca06149bbbe6fabec3d413dbef188f540568d68319df61e9c0d789e77489fe9893f8f4459f6b03cfef4a5b42095

    • SSDEEP

      192:M8hsvsRImy1MTb0LB1GeagkQqzzzgWGZIVW0Gdcen9CpNlPdhr3f8nYny7+zjW66:Mi0gg2zWia9SVnyqOZ

    Score
    3/10
    execution
    behavioral28behavioral29

    • Target

      avcodec-58.dll

    • Size

      5.4MB

    • MD5

      f63bb2c0ec4e25a2a36c676e6a61e46c

    • SHA1

      f2ec51ae3440cb5b86d4f73a4c7c466ea5b25db2

    • SHA256

      d3a72ea93dc6267b25b534b59e46aae4fc9f4d1a72fb46f3b9ec9f83052805c3

    • SHA512

      a3712fbacaba2259e1fb5d6fc7917ff7bf8b00d28837206c5108b9086564b1b305f11da4f50c30471f64f3d12236eec5340ea4fa652271f446605a50f155e380

    • SSDEEP

      98304:01e1E1gKlO+cPInIJchD6wi8x8UnK9flKCWDFfo/g79SEF:2e1E1gKlqJch2AKn/g79S

    Score
    3/10
    behavioral30behavioral31

    • Target

      avformat-58.dll

    • Size

      1.1MB

    • MD5

      7ef7ff13e83c7d924a3bf013e87133ca

    • SHA1

      55fd3ab50d5b54a12cddcc6a6d91c7a7b45231ea

    • SHA256

      93866a00bc5b8620663477979dabdce7856632a3f2e5a06127ca7ed6840f6af2

    • SHA512

      0b916846835e7a91335ee20ec95c5197de7ffb61a2657526b004e742459989f769a0e32a02ecdea6b34d0e8e3972b8eae4c9e34b86f4cc7e0a764ca18c28a856

    • SSDEEP

      24576:67oXnTvBPNlD8hcjInivAZlOYW6T5US0GCjk+208N71gJJV9999SLnBW:68nT5fDTALzkSikPhN7Lnc

    Score
    3/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks