qqpass | ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579

General

Target

ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Size

157KB
MD5

696fc251c51accb3ec998c120cbbd6b4
SHA1

53b0d2529487acbf53c2da82c0cbff624b86a11f
SHA256

ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579
SHA512

fedc23f5abdefc40088b29a7ce6ed72ddc8861d800a30f83573b70a82bada370e51d8a136dac97ff719988ca4a4f162357ae0a1a87f6d3990b6eb29af31e69be
SSDEEP

3072:fhfxHNIBdQmNitcrE4mzfOv9lH5ANJaYN2:f1piBdfitcrCDOzHWt2

Score

10^/10

qqpass discovery persistence trojan

Malware Config

Extracted

Family

qqpass

C2

http://www.iceboy.net/iceboy.htm?id=100000

Attributes

url
http://www.iceboy.net/automyexe_up.exe
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

QQpass
QQpass is a trojan written in C++..
trojan qqpass
Qqpass family
qqpass

Executes dropped EXE 1 IoCs

pid	Process
3000	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
File created	C:\Windows\SysWOW64\¢«.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
File created	C:\Windows\system\rundll32.exe	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1742384804"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1742384804"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
3000	rundll32.exe
3000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30
PID 2068 wrote to memory of 3000	2068	ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe	30

C:\Users\Admin\AppData\Local\Temp\ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe
"C:\Users\Admin\AppData\Local\Temp\ad4e43c296abf0fae7cb4bf6b803cfd388cf93517a568a671684a23ab0059579.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
170KB

MD5
e8ee34ff387b6b684f179cfccaaa2cbb

SHA1
17aefc50ae5dca12103b3aeb23a4d72be2eaa8de

SHA256
07d52182c59a7f9626f4c1b26055f1eabf1fa99758102e90236072d890749fba

SHA512
58b46ee11ed5fe3b07173b9d28f0b3aec80f0d7739180b682fe4fee997732fb7a57d082713ff501385253dd6742cbe0a2bc2187ad31826a9999832adea6e4bfe

Download Submit
\Windows\system\rundll32.exe

Filesize
168KB

MD5
9db4d83c1fcd4f8be4bf2c18de403454

SHA1
cd16f8d0fa895d38f83e37b1eee50cbd2d01ce9f

SHA256
4135b75c225510dc70ada2f942a259867ce0a708693adb38a9587e3ac252a934

SHA512
7c85751af0328cc7dc48e7488554c2f8eb4ee28046573631bffe259a0b9ea7b5044adbd51fb70207e23209b1dd37010f1b9fd061245155594f9784fec04d9b40

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads