Overview

overview

10

Static

static

3

1796369efd...e0.exe

windows7-x64

10

1796369efd...e0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    22/08/2024, 08:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe

  • Size

    80KB

  • MD5

    a5cd8fc525b13f71b9051df0df4c81bc

  • SHA1

    b03143816c1bce1584a7b010049ccaf1bb61b539

  • SHA256

    1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0

  • SHA512

    4d565650babf1c64299fa8d917e1c0e4cdd15820fde47891f5a8e027f260b6e731fbad0d3636e5bb239a0df2b6669b453c044857b9967311e47b7c2efefb038b

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOTpas:GhfxHNIreQm+Hispas

Score
10/10
qqpassdiscoverypersistencetrojan

Malware Config

Extracted

Family

qqpass

C2

http://www.zigui.org/article.php?id=103822

Attributes
  • url

    http://www.mxm9191.com/myrunner_up.exe

  • user_agent

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

  • QQpass

    QQpass is a trojan written in C++..

    trojanqqpass
  • Qqpass family
    qqpass
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
    "C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:856
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
    1⤵
      PID:1496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\notepad¢¬.exe
      Filesize

      80KB

      MD5

      800ba13f1084005a0c342b57b336f553

      SHA1

      ed3b26a786b2c1253d8d9e92b4e7b305903940ee

      SHA256

      59a7b194cb160bf92f2d5318de0339bc508dce44a3184a715fbd755181acfca8

      SHA512

      9cfccbca09c4337874783e689fc88a949e5838216a3594be74ecec16c345c192ef2fd4000d016eaef9a24977639dc87c5e40a5ee4e3d5ad7223c8a193b8613cf

      Download Submit

    • C:\Windows\System\rundll32.exe
      Filesize

      81KB

      MD5

      52c6df7b45a1492ee2a73338b61d6a13

      SHA1

      34e89928321f061370519d2038378cc553aea4be

      SHA256

      5ba2ef08d621826a93b868207bea0100329824fa4b8bd2d80ad832c18a9780fe

      SHA512

      6eefce8adb290416c0ba25c961c89ef276c930e4b8d1a60bfbd2b24ba141ccb10590033a3565540409401f1cb2c7adde04cfbb16ec4e4751862ac35e842eac8b

      Download Submit

    • memory/856-14-0x0000000000400000-0x0000000000415A00-memory.dmp

      Filesize

      86KB

      Download

    • memory/3960-0-0x0000000000400000-0x0000000000415A00-memory.dmp

      Filesize

      86KB

      Download

    • memory/3960-13-0x0000000000400000-0x0000000000415A00-memory.dmp

      Filesize

      86KB

      Download