qqpass | f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe
Size

350KB
MD5

f7442352f7cdd82539cbe34770c23bdd
SHA1

0eae8098ff5d50573b9be9328dc1e3fb4e255aa6
SHA256

f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9
SHA512

cfc025199fc9faa82c6dd8a1ddb0d80b63c28ed059992dbf1ece788aca1775cf4d2d5d73eb1cf9d0a1d12a64c3a911f725a74ba6caa81399806a2d5a68141c18
SSDEEP

6144:/90LamoFY2ari9ghin3SyTIMuxQlw/f/bmSGFol:/GLammY2aoKcSyMbxQlw/f/bZG+l

Score

10^/10

qqpass discovery trojan upx

Malware Config

Extracted

Family

qqpass

http://cf.qq.com/act/a20141214luxury/?ADTAG=client.btn.detail

Attributes

url
http://i3.tietuku.com/801db876cdcaa96c.png
user_agent
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

QQpass
QQpass is a trojan written in C++..
trojan qqpass
Qqpass family
qqpass

Executes dropped EXE 1 IoCs

pid	Process
2316	Sysceamrjbgo.exe

Loads dropped DLL 2 IoCs

pid	Process
2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe
2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2424-0-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2424-9-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/files/0x00080000000170f8-11.dat	upx
behavioral1/memory/2424-21-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2316-22-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe
2316	Sysceamrjbgo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2316	2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe	30
PID 2424 wrote to memory of 2316	2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe	30
PID 2424 wrote to memory of 2316	2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe	30
PID 2424 wrote to memory of 2316	2424	f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe	30

C:\Users\Admin\AppData\Local\Temp\f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe
"C:\Users\Admin\AppData\Local\Temp\f477d38438427882a0ed121221ca070c9129cd9e3ebe63ec090896da59580ff9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\Sysceamrjbgo.exe
  "C:\Users\Admin\AppData\Local\Temp\Sysceamrjbgo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cpath.ini

Filesize
102B

MD5
b17711e9c214d3a6cfa8f54239125348

SHA1
e8327bd11a0c30cac4108992cb4c1702df79c489

SHA256
0033a317c006fb6c7267521bf75bb2e73b6019b9673cfee51f37b8e22a74458c

SHA512
bcd320899aac9ad8fa866a8650e4cb1e0307632254eeb0ba60d6482c77b94f1d0018fb163ede81f8255360723a04cb8d012827c87f38a7b27ceaa076ff69c162

Download Submit
\Users\Admin\AppData\Local\Temp\Sysceamrjbgo.exe

Filesize
350KB

MD5
e5702a72f45821cb2ae6f7ecb2049692

SHA1
3dcfdae85503718f966b82b324a8ad0aa91ad4be

SHA256
0793f63f6a52cb6c7ce6e66b7054e09829a435627e31e0449a080a469c819087

SHA512
e594719f80d0f87ab951c7f8e88b1d956088fc474a1300e693c6fe6bb91875ba32d1631ed3ae635a78fe39c1fc30e664ee9e950167d446dda19ebed21ee71d08

Download Submit
memory/2316-22-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2424-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2424-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2424-17-0x0000000003800000-0x000000000385B000-memory.dmp

Filesize
364KB

Download
memory/2424-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download