Overview

overview

10

Static

static

3

bc0ceb1eee...29.exe

windows7-x64

10

bc0ceb1eee...29.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    01/09/2024, 07:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe

  • Size

    74KB

  • MD5

    ba5cce8890b56e70038224f949801fb7

  • SHA1

    836352f8ce5b3ab527a5f41a630125dcba850aa6

  • SHA256

    bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29

  • SHA512

    1decf3d4fdfa4dc3dddb2b2880df0e9f62b8b6f94ea870655f84cb838c8a6602c1e80085f0162130f3806307eca3e72fe0c5fd0306df2a0de6d47b6792f5edf5

  • SSDEEP

    768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOaN:RshfSWHHNvoLqNwDDGw02eQmh0HjWOaN

Score
10/10
qqpassdiscoverypersistencetrojan

Malware Config

Extracted

Family

qqpass

C2

http://www.zigui.org/article.php?id=103822

Attributes
  • url

    http://www.mxm9191.com/myrunner_up.exe

  • user_agent

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

  • QQpass

    QQpass is a trojan written in C++..

    trojanqqpass
  • Qqpass family
    qqpass
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe
    "C:\Users\Admin\AppData\Local\Temp\bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe
    Filesize

    82KB

    MD5

    97428ee523ea88fe1637c5d821aaede8

    SHA1

    a6bdd80d58841cb254ae94dd00bbe1b24bf62252

    SHA256

    740a9542dcf5d8db93edf53aaccbad7b57f4eb3c3cc883cffba8d9202b53eef7

    SHA512

    ed6d84333fe5d1bb90dafa5452ff9d63052f06ecb8ec41670c86c2dda59384b2fad46b21c7525096f40db6484b0a67f78847d78126c83e6fd1902882ac16d0ef

    Download Submit

  • C:\Windows\System\rundll32.exe
    Filesize

    84KB

    MD5

    59910fa54a634291cf6ace3b8f2e96d9

    SHA1

    d59b15af0ca9bf52f0112540aeadaf6c3072b7a4

    SHA256

    f07c8e5a5ec03f0b5e339805f34aa89c405043d3311f2dba4fb927d1b703a6c2

    SHA512

    1d7d3b19625b9bdca1cf415799b50af95a20b297dfbad022904cc0f83f93a38b8d9c2af488c5b388cc1ed55fc441be2cfe7908fe1845a51507c8173e4a9c7c1b

    Download Submit

  • memory/64-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download

  • memory/64-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download

  • memory/2072-14-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download