Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24-05-2024 02:57
General
-
Target
Original/chqpl.exe
-
Size
255KB
-
MD5
c6315a09e06e2ba775e5be0979d23755
-
SHA1
68abb2c430eebcad865157b4ef3e25f23ec5daca
-
SHA256
0e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
-
SHA512
6895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
-
SSDEEP
6144:E9kZ+d0Wm7M5MyYzWteHu4HCRdfKgvaY:E9OnWm7S26eAf5iY
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe"C:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\googleupdaterr.exeC:\Users\Admin\AppData\Local\Temp\Original\chqpl.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5c6315a09e06e2ba775e5be0979d23755
SHA168abb2c430eebcad865157b4ef3e25f23ec5daca
SHA2560e2706d24d9aaf93a2c9181a892367bb6094cf658c97b237d336f0651f35ff5b
SHA5126895a0dd192ce95a4a9c2ce51cc7e0cfcdcc5a024e6e83e39528f10b835b7eb329deebc72b258c25968291f4c06f27e1a7d06007ee785f684ba920d097e7cb5a
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
164KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
268KB
-
Filesize
276KB
-
Filesize
8KB
-
Filesize
276KB
-
Filesize
268KB