Overview

overview

10

Static

static

10

virus/Fidd...st.exe

windows10-ltsc 2021-x64

10

$PLUGINSDI...up.exe

windows10-ltsc 2021-x64

9

$PLUGINSDI...em.dll

windows10-ltsc 2021-x64

3

Analytics.dll

windows10-ltsc 2021-x64

1

Be.Windows...ox.dll

windows10-ltsc 2021-x64

1

DotNetZip.dll

windows10-ltsc 2021-x64

1

EnableLoopback.exe

windows10-ltsc 2021-x64

7

ExecAction.exe

windows10-ltsc 2021-x64

1

FSE2.exe

windows10-ltsc 2021-x64

3

Fiddler.exe

windows10-ltsc 2021-x64

4

ForceCPU.exe

windows10-ltsc 2021-x64

1

GA.Analyti...or.dll

windows10-ltsc 2021-x64

1

ImportExpo...ts.dll

windows10-ltsc 2021-x64

1

ImportExpo...rt.dll

windows10-ltsc 2021-x64

1

Inspectors...on.dll

windows10-ltsc 2021-x64

1

Inspectors...or.dll

windows10-ltsc 2021-x64

1

Inspectors...es.dll

windows10-ltsc 2021-x64

1

Inspectors...ax.dll

windows10-ltsc 2021-x64

1

Inspectors...rd.dll

windows10-ltsc 2021-x64

1

Inspectors...ew.dll

windows10-ltsc 2021-x64

1

Newtonsoft.Json.dll

windows10-ltsc 2021-x64

1

Plugins/Ne...ws.dll

windows10-ltsc 2021-x64

1

ScriptEdit...cs.dll

windows10-ltsc 2021-x64

1

ScriptEdit...or.dll

windows10-ltsc 2021-x64

1

ScriptEdit...on.dll

windows10-ltsc 2021-x64

1

ScriptEdit...or.dll

windows10-ltsc 2021-x64

1

ScriptEdit...rs.dll

windows10-ltsc 2021-x64

1

ScriptEdit...ax.dll

windows10-ltsc 2021-x64

1

Scripts/Fi...on.dll

windows10-ltsc 2021-x64

1

Scripts/Fi...on.dll

windows10-ltsc 2021-x64

1

$PLUGINSDI...em.dll

windows10-ltsc 2021-x64

3

virus/Froz...ED.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    1625s
  • max time network
    1114s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    11-12-2024 18:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Inspectors/QWhale.Editor.dll

  • Size

    816KB

  • MD5

    eaa268802c633f27fcfc90fd0f986e10

  • SHA1

    21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

  • SHA256

    fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

  • SHA512

    c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

  • SSDEEP

    12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Inspectors\QWhale.Editor.dll,#1
    1⤵
      PID:4360
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4372,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
      1⤵
        PID:216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=3164,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
        1⤵
          PID:1460
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5240,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:8
          1⤵
            PID:1200
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=1344,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
            1⤵
              PID:5048
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=3204,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
              1⤵
                PID:644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=4104,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
                1⤵
                  PID:2804
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5296,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:8
                  1⤵
                    PID:1372
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=1364,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
                    1⤵
                      PID:3624
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5172,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
                      1⤵
                        PID:1328
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4728,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
                        1⤵
                          PID:4972
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5408,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
                          1⤵
                            PID:4996
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5468,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
                            1⤵
                              PID:1640
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5636,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
                              1⤵
                                PID:4804
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5528,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
                                1⤵
                                  PID:1180
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5344,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
                                  1⤵
                                    PID:3440
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5476,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
                                    1⤵
                                      PID:2120
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5600,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
                                      1⤵
                                        PID:3560
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5300,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
                                        1⤵
                                          PID:3104
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5616,i,9737432187879230445,9821035639225357588,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
                                          1⤵
                                            PID:4508

                                          Network

                                          MITRE ATT&CK Matrix

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads