e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
Size

3.2MB
MD5

5cf5f2ec62a881434ecf90fdda10c717
SHA1

98bf8c6f05f5b4c85ac61ed19c5b1d69346e899e
SHA256

e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536
SHA512

91cc8f1b3b6501648a6893855152ca11f827bf9e5cd3d02369b02358a87c0d3f3f22b35f9bb536ab66d1b84c02d54ff565a02f763226f98e28f527c2a10e37b0
SSDEEP

49152:klV0aewXd/ZsH9XST8mqliUkj2Gik5GCUmqsEDuLKw4FJuB7SOLCArtXxPLN5Bpr:kMFWMpSw7hkjJfH18uLJfLhrXzN56c

Score

7^/10

aspackv2 discovery persistence vmprotect

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000015ec9-25.dat	aspack_v212_v242
behavioral1/files/0x0007000000015e48-38.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2160	QQbrowrse.exe
2696	Explorer.exe

Loads dropped DLL 4 IoCs

pid	Process
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x0000000000AA8000-memory.dmp	vmprotect
behavioral1/memory/1732-10-0x0000000000400000-0x0000000000AA8000-memory.dmp	vmprotect
behavioral1/memory/1732-12-0x0000000000400000-0x0000000000AA8000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQbuse = "C:\\Program Files\\Adobe\\Explorer.exe"	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQbrowrse = "C:\\Program Files\\idcdps\\QQbrowrse.exe"	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQbuser = "C:\\Program Files\\Adobe\\Delete.exe"	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Adobe\Delete.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File opened for modification	C:\Program Files\Adobe\Delete.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File opened for modification	C:\Program Files\Adobe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File opened for modification	C:\Program Files\idcdps	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File created	C:\Program Files\Adobe\Explorer.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File opened for modification	C:\Program Files\Adobe\Explorer.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File created	C:\Program Files\idcdps\QQbrowrse.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
File opened for modification	C:\Program Files\idcdps\QQbrowrse.exe	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQbrowrse.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
2160	QQbrowrse.exe
2160	QQbrowrse.exe
2696	Explorer.exe
2696	Explorer.exe
1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2160	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	30
PID 1732 wrote to memory of 2160	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	30
PID 1732 wrote to memory of 2160	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	30
PID 1732 wrote to memory of 2160	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	30
PID 1732 wrote to memory of 2696	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	31
PID 1732 wrote to memory of 2696	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	31
PID 1732 wrote to memory of 2696	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	31
PID 1732 wrote to memory of 2696	1732	e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe	31

C:\Users\Admin\AppData\Local\Temp\e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe
"C:\Users\Admin\AppData\Local\Temp\e250b1ce24d6778dad8e403e30c103eef56829abe5dfd2d10eb4b86b76212536.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files\idcdps\QQbrowrse.exe
  "C:\Program Files\idcdps\QQbrowrse.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2160
- C:\Program Files\Adobe\Explorer.exe
  "C:\Program Files\Adobe\Explorer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Adobe\Explorer.exe

Filesize
346KB

MD5
a02ed11068e7d7c2810b451b5395afcd

SHA1
91954baf6478d1dbec3368a8c4b6dd42e84e0c80

SHA256
ac52f45537f49ad030a0604310b898ba851e7816806f0442dcc1cfec29edad74

SHA512
e2174309a9ff3472577dc7ac33fc46643c32cd5575247f743274d0ff48f52bfc164c625c5fe768c3fa1e959ab984f94668806d99703a12a922b303cab818cc5a

Download Submit
C:\Program Files\idcdps\QQbrowrse.exe

Filesize
346KB

MD5
e5da9622e7e80d3e5ce91580e2da9b5f

SHA1
47c4354de550a1a08ad58fc54632cbf584344121

SHA256
3fc20c59498bb3131c58c1bbbe2e09bcf839d5970ab1a93f76ee1b91c6ae1b40

SHA512
66348bd488cb0f4be012daf4b4df5556c12138b25bba8b1d73d7debf3f2fb8454cd314af509e2ef79022cf79c8cc79f9839f7a366fb6250c655df35597aae21d

Download Submit
memory/1732-12-0x0000000000400000-0x0000000000AA8000-memory.dmp

Filesize
6.7MB

Download
memory/1732-4-0x00000000772E0000-0x00000000772E1000-memory.dmp

Filesize
4KB

Download
memory/1732-8-0x0000000075A50000-0x0000000075A51000-memory.dmp

Filesize
4KB

Download
memory/1732-10-0x0000000000400000-0x0000000000AA8000-memory.dmp

Filesize
6.7MB

Download
memory/1732-40-0x0000000003550000-0x0000000003651000-memory.dmp

Filesize
1.0MB

Download
memory/1732-2-0x00000000772E0000-0x00000000772E1000-memory.dmp

Filesize
4KB

Download
memory/1732-0-0x0000000000400000-0x0000000000AA8000-memory.dmp

Filesize
6.7MB

Download
memory/1732-59-0x0000000003550000-0x0000000003651000-memory.dmp

Filesize
1.0MB

Download
memory/1732-31-0x0000000003550000-0x0000000003651000-memory.dmp

Filesize
1.0MB

Download
memory/1732-30-0x0000000003550000-0x0000000003651000-memory.dmp

Filesize
1.0MB

Download
memory/1732-1-0x000000000053C000-0x0000000000737000-memory.dmp

Filesize
2.0MB

Download
memory/2160-60-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-65-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-73-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-71-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-26-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-69-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-29-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-44-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-67-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-46-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-63-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-48-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-27-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-50-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-28-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-52-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-58-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-54-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2160-56-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-64-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-74-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-55-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-51-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-49-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-61-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-62-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-47-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-53-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-57-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-45-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-66-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-68-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-39-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-70-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-41-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-72-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-42-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2696-43-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download