Resubmissions
29-10-2024 18:15
241029-wvvbvaxhpn 10Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 18:15
Behavioral task
behavioral1
Sample
QhtbqjQkwerkQM.exe
Resource
win7-20241010-en
General
-
Target
QhtbqjQkwerkQM.exe
-
Size
9.4MB
-
MD5
3058d08d8d69deae85ded336f0d634e8
-
SHA1
e729a30da097e8d3f2a9da410f00c3a6c517dd8e
-
SHA256
4b7bd823a8689239505d1c056beee701eb575e1b7e6f43aa17878365e805e29a
-
SHA512
5cbd1f670e876d8f2627a26802a9d84a96b5401b6cc3850bf019c254182b09be891d26cc847399071cf897e745db02c323960aec625d179648fb837f8c4ea361
-
SSDEEP
196608:Fw0113cumcMIXdZeNTfm/pf+xk4dWRpmrbW3jmrx:n3cEky/pWu4kRpmrbmyrx
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2436 QhtbqjQkwerkQM.exe -
resource yara_rule behavioral1/files/0x0005000000019820-22.dat upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 QhtbqjQkwerkQM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2436 2448 QhtbqjQkwerkQM.exe 30 PID 2448 wrote to memory of 2436 2448 QhtbqjQkwerkQM.exe 30 PID 2448 wrote to memory of 2436 2448 QhtbqjQkwerkQM.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\QhtbqjQkwerkQM.exe"C:\Users\Admin\AppData\Local\Temp\QhtbqjQkwerkQM.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\QhtbqjQkwerkQM.exe"C:\Users\Admin\AppData\Local\Temp\QhtbqjQkwerkQM.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2436
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31