Overview
overview
7Static
static
3SecuriteIn...07.exe
windows7-x64
7SecuriteIn...07.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3dqwhj_errwd.exe
windows7-x64
3dqwhj_errwd.exe
windows10-2004-x64
3iconAnimate.exe
windows7-x64
3iconAnimate.exe
windows10-2004-x64
3iconTips.exe
windows7-x64
3iconTips.exe
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.FileRepMalware.6479.21607.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.FileRepMalware.6479.21607.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
dqwhj_errwd.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
dqwhj_errwd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
iconAnimate.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
iconAnimate.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
iconTips.exe
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
iconTips.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
uninst.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
uninst.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
General
-
Target
uninst.exe
-
Size
196KB
-
MD5
80b05828a4c0d54e3a3ca2a4cd61492a
-
SHA1
f27df18439239725862d94450d284a4e41e5384b
-
SHA256
9b381dcb55d28fcb668b6f9e4209a7b67c332c5179517fb6ba78fd3f701b8bdc
-
SHA512
b64e6dce7732d57c62236412cc0f4d08bccaef472134a4b905a3cbbb0c0a7b8b49a58bc1660df1b329621b653c333003840e30293077002c48f931b0333542c3
-
SSDEEP
3072:BQIURTXJw9XG7MY4VwfavMfAIKiUzKEMIwIyFU2kaf5OQW70HTGrBMhSYfAalScH:BseWrnf3IteEryTkaf5OFQzGr2h9ScH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1132 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 1132 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 1132 Au_.exe 1132 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 dqwhj_errwd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dqwhj_errwd.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral18/files/0x0009000000023baf-4.dat nsis_installer_1 behavioral18/files/0x0009000000023baf-4.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1132 Au_.exe 1132 Au_.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe 1612 dqwhj_errwd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 880 wrote to memory of 1132 880 uninst.exe 86 PID 880 wrote to memory of 1132 880 uninst.exe 86 PID 880 wrote to memory of 1132 880 uninst.exe 86 PID 1132 wrote to memory of 1612 1132 Au_.exe 94 PID 1132 wrote to memory of 1612 1132 Au_.exe 94 PID 1132 wrote to memory of 1612 1132 Au_.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\dqwhj_errwd.exe"C:\Users\Admin\AppData\Local\Temp\dqwhj_errwd.exe" /uninstallsucc3⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409B
MD5edc33c0698acdf92e10e9672ba5c4db2
SHA18fbed53c547720a3cf9cadbe1b55bf1d465ca3e4
SHA2561a2122161b14e1298e058c6a971b955cfe428c80e565b544fb9a6162e6116d3f
SHA5120e2eab36b2df6684981f4d5468f7210553b74fb27333505490dc43be384fb5b619caf011bb641d47fbbf1b260c2fc877a6ee9ff7b3e20762c6a249d91b2d8d88
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
Filesize
196KB
MD580b05828a4c0d54e3a3ca2a4cd61492a
SHA1f27df18439239725862d94450d284a4e41e5384b
SHA2569b381dcb55d28fcb668b6f9e4209a7b67c332c5179517fb6ba78fd3f701b8bdc
SHA512b64e6dce7732d57c62236412cc0f4d08bccaef472134a4b905a3cbbb0c0a7b8b49a58bc1660df1b329621b653c333003840e30293077002c48f931b0333542c3