def77dec17108dc1cf940823eee4a83762a8e50dce9a2978abfaf5f1a6438ab4

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lqtxupdater.exe
Size

757KB
MD5

3c91c9b98e30cd339329114c26a7ed5f
SHA1

e952a3d915deddec7bfddba1c3500065663cc229
SHA256

def77dec17108dc1cf940823eee4a83762a8e50dce9a2978abfaf5f1a6438ab4
SHA512

cabc5be97ba196e89cf766013c036d4e96177fd7962f414eee12e103f5bcbc03be42f1c927384e067784c89ad640c532680c57228f07288ebdceda0cc1f449d1
SSDEEP

12288:PFUNDaE/9LlbRRaHIKhbBkSHgcUBEthBw4f+1uPCVe2z7grsunc:PFOa+PR+VhNkI1/thBrf+wIlgrtnc

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4416	lqtxupdater.exe
3764	icsys.icn.exe
512	explorer.exe
540	spoolsv.exe
4692	svchost.exe
1728	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	lqtxupdater.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lqtxupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
4140	lqtxupdater.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
3764	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
512	explorer.exe
4692	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4140	lqtxupdater.exe
4140	lqtxupdater.exe
3764	icsys.icn.exe
3764	icsys.icn.exe
512	explorer.exe
512	explorer.exe
540	spoolsv.exe
540	spoolsv.exe
4692	svchost.exe
4692	svchost.exe
1728	spoolsv.exe
1728	spoolsv.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4416	4140	lqtxupdater.exe	89
PID 4140 wrote to memory of 4416	4140	lqtxupdater.exe	89
PID 4140 wrote to memory of 3764	4140	lqtxupdater.exe	90
PID 4140 wrote to memory of 3764	4140	lqtxupdater.exe	90
PID 4140 wrote to memory of 3764	4140	lqtxupdater.exe	90
PID 3764 wrote to memory of 512	3764	icsys.icn.exe	92
PID 3764 wrote to memory of 512	3764	icsys.icn.exe	92
PID 3764 wrote to memory of 512	3764	icsys.icn.exe	92
PID 4416 wrote to memory of 4232	4416	lqtxupdater.exe	93
PID 4416 wrote to memory of 4232	4416	lqtxupdater.exe	93
PID 4232 wrote to memory of 2520	4232	cmd.exe	94
PID 4232 wrote to memory of 2520	4232	cmd.exe	94
PID 4232 wrote to memory of 3720	4232	cmd.exe	95
PID 4232 wrote to memory of 3720	4232	cmd.exe	95
PID 4232 wrote to memory of 3888	4232	cmd.exe	96
PID 4232 wrote to memory of 3888	4232	cmd.exe	96
PID 512 wrote to memory of 540	512	explorer.exe	97
PID 512 wrote to memory of 540	512	explorer.exe	97
PID 512 wrote to memory of 540	512	explorer.exe	97
PID 540 wrote to memory of 4692	540	spoolsv.exe	98
PID 540 wrote to memory of 4692	540	spoolsv.exe	98
PID 540 wrote to memory of 4692	540	spoolsv.exe	98
PID 4692 wrote to memory of 1728	4692	svchost.exe	99
PID 4692 wrote to memory of 1728	4692	svchost.exe	99
PID 4692 wrote to memory of 1728	4692	svchost.exe	99

C:\Users\Admin\AppData\Local\Temp\lqtxupdater.exe
"C:\Users\Admin\AppData\Local\Temp\lqtxupdater.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140
- \??\c:\users\admin\appdata\local\temp\lqtxupdater.exe
  c:\users\admin\appdata\local\temp\lqtxupdater.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "c:\users\admin\appdata\local\temp\lqtxupdater.exe " MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "c:\users\admin\appdata\local\temp\lqtxupdater.exe " MD5
      4⤵
      PID:2520
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:3720
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:3888
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:512
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:540
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3708,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lqtxupdater.exe

Filesize
622KB

MD5
d16a88f2bd7691a3e148145a63fe1e69

SHA1
f2efbbcde0a85d206760bcfe2ec5266bf28d5a00

SHA256
287155f9fceef4c03354c75fba5a5f243e94627937a60f7075abb6133b350cac

SHA512
f70c59a79fa4ab5af24bdc24c2fd81b2405617b320d958cc767995e2b5af34c0169b9b1791ef943b299ee76de96683163aa64d1f7a497b0720c5c8113c6e84f9

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
d58e79299422270192a1bb3151916f33

SHA1
f1a9f83b136bb09abc769aadb0d99eacba67b063

SHA256
a33ea21015120f5480973d55b38af8a39c4baca978b962433fcff7982f6de6c7

SHA512
618f72ad564c083d2663624e55ae486a23a907ff0e35c9e7ce7e2c6eb88dfc5e62b9002bb2dad85f9926ff64e89dc745ff536a4f4e327004429bd38e36ad19ab

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
4eccaa7fb5d78a8274236ba623c4275d

SHA1
c4b7996cdb80a207f9867c7e9820495ab8f9ab6f

SHA256
713e7d714f51915551a66cb76b40b68ae993382519d38abc71a15ccda1a93ddc

SHA512
66cca2a4bc663ef5c417451767ee96a115de5550d044feccde55ed94fb2e86bf28491ccbd53100a708c44b09ff01c59b0028126dfde0ffd28fc4eb02e91b3d3b

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
bf1d0800908be6a0e0522a3521445340

SHA1
5bfed8e4d493f3a885ed34c580ca365f977bd139

SHA256
568ed599db7b19cb181dc0e45558f9e144ec56da94aef17ff7ee5ac4402b0037

SHA512
66bdbfafc9a4d1f0fd63c76bcba45f90655981011b664bca45f2a8eb179f117fd888b35959fa35f88404dee61138085b3e90cada2214831c8027874e4ff2957c

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
5763e399265c0ace7ce499a6bab6907a

SHA1
a269375d97cfd7949c0e10e7bf6e43cae5ce216e

SHA256
5e0b6d8681fd75591baaf13ef2664533888b28b79cf705f1dad92f28d13755f4

SHA512
887b0ce1d007fc3f5ee920c6c284c69cea8f3daf474c48ae3d4593402bd5317effc9c3bf94c3520a9eeb7eb355f94a205dbf32b5661323b097297e8010573990

Download Submit
memory/512-20-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/512-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/540-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1728-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3764-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4140-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4140-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4692-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download