Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
submitted
01/09/2024, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe
Resource
win10v2004-20240802-en
General
-
Target
bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe
-
Size
74KB
-
MD5
ba5cce8890b56e70038224f949801fb7
-
SHA1
836352f8ce5b3ab527a5f41a630125dcba850aa6
-
SHA256
bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29
-
SHA512
1decf3d4fdfa4dc3dddb2b2880df0e9f62b8b6f94ea870655f84cb838c8a6602c1e80085f0162130f3806307eca3e72fe0c5fd0306df2a0de6d47b6792f5edf5
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOaN:RshfSWHHNvoLqNwDDGw02eQmh0HjWOaN
Malware Config
Extracted
qqpass
http://www.zigui.org/article.php?id=103822
-
url
http://www.mxm9191.com/myrunner_up.exe
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Signatures
-
Qqpass family
-
Executes dropped EXE 1 IoCs
pid Process 2072 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\notepad¢¬.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe File opened for modification C:\Windows\SysWOW64\¢«.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe File created C:\Windows\SysWOW64\¢«.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe File created C:\Windows\system\rundll32.exe bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1725175250" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1725175250" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2072 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 2072 rundll32.exe 2072 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 64 wrote to memory of 2072 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 87 PID 64 wrote to memory of 2072 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 87 PID 64 wrote to memory of 2072 64 bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe"C:\Users\Admin\AppData\Local\Temp\bc0ceb1eee5fa5c428c5698b4fa2697d1fffa1f1f4c87111445abbffb3480c29.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD597428ee523ea88fe1637c5d821aaede8
SHA1a6bdd80d58841cb254ae94dd00bbe1b24bf62252
SHA256740a9542dcf5d8db93edf53aaccbad7b57f4eb3c3cc883cffba8d9202b53eef7
SHA512ed6d84333fe5d1bb90dafa5452ff9d63052f06ecb8ec41670c86c2dda59384b2fad46b21c7525096f40db6484b0a67f78847d78126c83e6fd1902882ac16d0ef
-
Filesize
84KB
MD559910fa54a634291cf6ace3b8f2e96d9
SHA1d59b15af0ca9bf52f0112540aeadaf6c3072b7a4
SHA256f07c8e5a5ec03f0b5e339805f34aa89c405043d3311f2dba4fb927d1b703a6c2
SHA5121d7d3b19625b9bdca1cf415799b50af95a20b297dfbad022904cc0f83f93a38b8d9c2af488c5b388cc1ed55fc441be2cfe7908fe1845a51507c8173e4a9c7c1b