Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:43
Static task
static1
Behavioral task
behavioral1
Sample
2a85eea8618c8ea2f164f59dcdd8e430N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a85eea8618c8ea2f164f59dcdd8e430N.exe
Resource
win10v2004-20240802-en
General
-
Target
2a85eea8618c8ea2f164f59dcdd8e430N.exe
-
Size
218KB
-
MD5
2a85eea8618c8ea2f164f59dcdd8e430
-
SHA1
2ac327d04c4c6271f640727517a6ef07fa48e745
-
SHA256
6d0e4fc09ce28fbad98adce3b6bbec515ab0f35ef1f63d38adb575e6c18890ac
-
SHA512
eb8501da4bdd6cfc47b15354bd8753c4a14bab8ef52c63e9b6b3b59661de5c94d8dc1fae688673dc04718d484cbb80669aa5578e7ba2378682c25e78967075ed
-
SSDEEP
3072:BqEH+GiEs2SMylNOjyFbxJz5qwPWYLWX7n6+QPzuy5cs4BfLK4GG0771PFKTtHOc:MsehzRFjutQPzpR41R3HHKXtGZa5Vs
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 4172 Rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation Rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 2912 QVODSE~1.EXE 1052 Qvod.exe -
Loads dropped DLL 3 IoCs
pid Process 4716 Rundll32.exe 4172 Rundll32.exe 4172 Rundll32.exe -
resource yara_rule behavioral2/files/0x00070000000234dc-21.dat upx behavioral2/memory/1052-22-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-28-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-29-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-31-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-33-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-34-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-36-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1052-38-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2a85eea8618c8ea2f164f59dcdd8e430N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe" Rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xtgmpgaa.dll QVODSE~1.EXE File created C:\Windows\SysWOW64\gkknpgaa.dll QVODSE~1.EXE -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\KAV\CDriver.sys Rundll32.exe File opened for modification C:\Program Files\KAV\CDriver.Inf Rundll32.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3080 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a85eea8618c8ea2f164f59dcdd8e430N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVODSE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qvod.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 Rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc Rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4716 Rundll32.exe 4172 Rundll32.exe 4172 Rundll32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1052 Qvod.exe 1052 Qvod.exe 1052 Qvod.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1052 Qvod.exe 1052 Qvod.exe 1052 Qvod.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2912 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 85 PID 2552 wrote to memory of 2912 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 85 PID 2552 wrote to memory of 2912 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 85 PID 2912 wrote to memory of 4716 2912 QVODSE~1.EXE 86 PID 2912 wrote to memory of 4716 2912 QVODSE~1.EXE 86 PID 2912 wrote to memory of 4716 2912 QVODSE~1.EXE 86 PID 4716 wrote to memory of 3080 4716 Rundll32.exe 89 PID 4716 wrote to memory of 3080 4716 Rundll32.exe 89 PID 4716 wrote to memory of 3080 4716 Rundll32.exe 89 PID 2912 wrote to memory of 4172 2912 QVODSE~1.EXE 91 PID 2912 wrote to memory of 4172 2912 QVODSE~1.EXE 91 PID 2912 wrote to memory of 4172 2912 QVODSE~1.EXE 91 PID 2552 wrote to memory of 1052 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 92 PID 2552 wrote to memory of 1052 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 92 PID 2552 wrote to memory of 1052 2552 2a85eea8618c8ea2f164f59dcdd8e430N.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a85eea8618c8ea2f164f59dcdd8e430N.exe"C:\Users\Admin\AppData\Local\Temp\2a85eea8618c8ea2f164f59dcdd8e430N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QVODSE~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QVODSE~1.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\xtgmpgaa.dll Exucute3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop PolicyAgent4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3080
-
-
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\gkknpgaa.dll Exucute3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4172
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qvod.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qvod.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1052
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD56c7cdd25c2cb0073306eb22aebfc663f
SHA1a1eba8ab49272b9852fe6a543677e8af36271248
SHA25658280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
SHA51217344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
-
Filesize
73KB
MD5ef6b2b097300ec0a81cc063e16305cda
SHA166794f1b1f5e47884f4a898fe1f19758c1d787ab
SHA256989be882d6bf81d19c91567e49c20759bfa5cd7c0f94c8d12c3aa7904a721899
SHA512abf0466fbff72763144ec44d667eeb4a270f6e8682a0f12bf432054f7ae8683147377c35ad29fce29b99764018ff679a4b5bbfa846295831be47cee57b731c2d
-
Filesize
149KB
MD57581986b4b6dbdfa780b2e22f660da71
SHA1dacd15537be973515e25840d94aa10dea81d7795
SHA256ff22384b18e3ecea38fdfabdca6d4695a129d411cc517bc96422f5a7ec5ae151
SHA5129d977a417ebc63ca07c1724e3097c3a3f1a8b602906e7119c55cd9b9c9f45f413bd36b90b1d8755fc8fbe848ad6a3c76a483c02df517b6b6229a9d2fbf412a5f
-
Filesize
10KB
MD585213b584ddff3bb5c87dc29b9ba5044
SHA10588b5d3abb74ecde921105c3fbca3d73d82fb87
SHA25651c86d4f585bfc3e7014d02d4c0d5b38b6770a62d39412f0227a954f5b5ad298
SHA512e11c622837669be193c011c09b53bf51c7af807218084d3358c7f8b185091289123bef33527e062e8df2e0a54fcc867701dac1d86fa15a97edab34b9420cf327
-
Filesize
57KB
MD50b5cc82cd70afcd5b012f7c4be41dd99
SHA1b7a136d337d7c24ee7e3af622da1a5aa03f3d944
SHA25665c7abdad7d1afba65c47022306358c35104c2aaf614e36261616a4ad3fe255e
SHA5128b6616179768b1cc8efc4fb3084a2ff596e512a7078c75e785ebef8bd47654e65c0a2709451c923714ceea3120237315dd2c57eb28e8076862b3f3d656a649ac