Overview

overview

10

Static

static

3

QW15F_file.exe

windows7-x64

10

QW15F_file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QW15F_file.exe

  • Size

    2.6MB

  • Sample

    241119-q986na1qbn

  • MD5

    53d6dbb2d9d750e447d981330aa89725

  • SHA1

    939d0dbaabef8e9834fe4436bb0b8cd0f17693cc

  • SHA256

    62ff58ed3ac61ecf3e4477425a8c89765786cbc419ae2831f15d9527fa41dd18

  • SHA512

    c186c99cf8a10e8738408acc3a6072a29f09355d06cbbc5bc2ea7477c611f632fe266812e6c026c0e6d8e05cdf56bcc0be1abadfcef393087e72186e87f36dca

  • SSDEEP

    49152:mjcx9H6HZ9bCTX8kTB6CnEU04WEtdCSYckNQwvxcMPB5j+1S9jwX0ztREO:mjE9H6HZ9GTMkTcyyEySYckNlJPB5jVZ

Score
10/10
discoveryevasiontrojan

Malware Config

Targets

    • Target

      QW15F_file.exe

    • Size

      2.6MB

    • MD5

      53d6dbb2d9d750e447d981330aa89725

    • SHA1

      939d0dbaabef8e9834fe4436bb0b8cd0f17693cc

    • SHA256

      62ff58ed3ac61ecf3e4477425a8c89765786cbc419ae2831f15d9527fa41dd18

    • SHA512

      c186c99cf8a10e8738408acc3a6072a29f09355d06cbbc5bc2ea7477c611f632fe266812e6c026c0e6d8e05cdf56bcc0be1abadfcef393087e72186e87f36dca

    • SSDEEP

      49152:mjcx9H6HZ9bCTX8kTB6CnEU04WEtdCSYckNQwvxcMPB5j+1S9jwX0ztREO:mjE9H6HZ9GTMkTcyyEySYckNlJPB5jVZ

    Score
    10/10
    discoveryevasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Windows security modification

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks