Overview
overview
4Static
static
3imager_1.8.5.exe
windows7-x64
4imager_1.8.5.exe
windows10-2004-x64
4QtGraphica...dow.js
windows7-x64
3QtGraphica...dow.js
windows10-2004-x64
3QtGraphica...lur.js
windows7-x64
3QtGraphica...lur.js
windows10-2004-x64
3QtGraphica...te.dll
windows7-x64
3QtGraphica...te.dll
windows10-2004-x64
3QtGraphica...in.dll
windows7-x64
3QtGraphica...in.dll
windows10-2004-x64
3QtQuick.2/...in.dll
windows7-x64
3QtQuick.2/...in.dll
windows10-2004-x64
3QtQuick/Co...in.dll
windows7-x64
3QtQuick/Co...in.dll
windows10-2004-x64
3QtQuick/Co...low.js
windows7-x64
3QtQuick/Co...low.js
windows10-2004-x64
3QtQuick/Co...in.dll
windows7-x64
3QtQuick/Co...in.dll
windows10-2004-x64
3QtQuick/Co...in.dll
windows7-x64
3QtQuick/Co...in.dll
windows10-2004-x64
3QtQuick/La...in.dll
windows7-x64
3QtQuick/La...in.dll
windows10-2004-x64
3QtQuick/Te...in.dll
windows7-x64
3QtQuick/Te...in.dll
windows10-2004-x64
3QtQuick/Wi...in.dll
windows7-x64
3QtQuick/Wi...in.dll
windows10-2004-x64
3bearer/qge...er.dll
windows7-x64
3bearer/qge...er.dll
windows10-2004-x64
3fat32format.exe
windows7-x64
1fat32format.exe
windows10-2004-x64
3iconengine...on.dll
windows7-x64
3iconengine...on.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
imager_1.8.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
imager_1.8.5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
QtGraphicalEffects/private/FastInnerShadow.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
QtGraphicalEffects/private/FastInnerShadow.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
QtGraphicalEffects/private/GaussianDirectionalBlur.js
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
QtGraphicalEffects/private/GaussianDirectionalBlur.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
QtGraphicalEffects/private/qtgraphicaleffectsprivate.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
QtGraphicalEffects/private/qtgraphicaleffectsprivate.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
QtGraphicalEffects/qtgraphicaleffectsplugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
QtGraphicalEffects/qtgraphicaleffectsplugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
QtQuick.2/qtquick2plugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
QtQuick.2/qtquick2plugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
QtQuick/Controls.2/Fusion/qtquickcontrols2fusionstyleplugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
QtQuick/Controls.2/Fusion/qtquickcontrols2fusionstyleplugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
QtQuick/Controls.2/Material/RectangularGlow.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
QtQuick/Controls.2/Material/RectangularGlow.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
QtQuick/Controls.2/Material/qtquickcontrols2materialstyleplugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
QtQuick/Controls.2/Material/qtquickcontrols2materialstyleplugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
QtQuick/Controls.2/qtquickcontrols2plugin.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
QtQuick/Controls.2/qtquickcontrols2plugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
QtQuick/Layouts/qquicklayoutsplugin.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
QtQuick/Layouts/qquicklayoutsplugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
QtQuick/Templates.2/qtquicktemplates2plugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
QtQuick/Templates.2/qtquicktemplates2plugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
QtQuick/Window.2/windowplugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
QtQuick/Window.2/windowplugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
bearer/qgenericbearer.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
bearer/qgenericbearer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
fat32format.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
fat32format.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
iconengines/qsvgicon.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
iconengines/qsvgicon.dll
Resource
win10v2004-20240910-en
General
-
Target
QtQuick/Layouts/qquicklayoutsplugin.dll
-
Size
288KB
-
MD5
3ec5bd0e97818053ddc2e4c4c3673be0
-
SHA1
93d11ee300d5053ecc809b6a77e6df7e1bf276b3
-
SHA256
20d2ad1c762d5d313299ff60a2501c02818acb77c4be89c53b6b427d41b9e1de
-
SHA512
b7832a36c305f07dee2ee4dca569742b5d01a2315e7c89487b88713c31651b1e40399c51ff96c211ed249e5c4f5ef2a7805040865fe14eb1087d7aee16080760
-
SSDEEP
6144:5gCqf2wRQT231t4yUbldPLbDc7cxAoBLWxlfUVstXhvdlGsMd0hmTz1hojkiZuNl:i392ZR
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30 PID 2112 wrote to memory of 2564 2112 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Layouts\qquicklayoutsplugin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Layouts\qquicklayoutsplugin.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2564
-