qqpass | a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2025, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Size

28KB
MD5

64cdbe318ab8921f4f797545fa28eaba
SHA1

c4884a6717dc010ff0af0735a078226734b80307
SHA256

a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f
SHA512

d5cc523260bc6b2fc30cbef932757fa062f41beffe98cdb0b2fdb0a34e4a980b9789c17f7c67281dbc68a0eff593bf1b8c2911cb31d5f563da5274264204927c
SSDEEP

768:plsh/EIjPBW7LmLq0bv7rox9vXy7xj000k:pr6P8uLq0bvuR+j

Score

10^/10

qqpass discovery persistence trojan

Malware Config

Extracted

Family

qqpass

http://www.rongshuxia.com/rss/viewart.rs?aid=1828

Attributes

url
http://www.mxm9191.com/myrunner_up.exe
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

QQpass
QQpass is a trojan written in C++..
trojan qqpass
Qqpass family
qqpass

Executes dropped EXE 2 IoCs

pid	Process
1356	rundll32.exe
2060	DMe.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File created	C:\Windows\SysWOW64\¢«.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File created	C:\Windows\SysWOW64\DMe.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File opened for modification	C:\Windows\SysWOW64\DMe.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
File created	C:\Windows\system\rundll32.exe	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DMe.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "510"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1742708547"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1742708547"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
2060	DMe.exe
2060	DMe.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe
1356	rundll32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
1356	rundll32.exe
2060	DMe.exe
1356	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 1356	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	89
PID 5256 wrote to memory of 1356	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	89
PID 5256 wrote to memory of 1356	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	89
PID 5256 wrote to memory of 2060	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	95
PID 5256 wrote to memory of 2060	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	95
PID 5256 wrote to memory of 2060	5256	a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe	95

C:\Users\Admin\AppData\Local\Temp\a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
"C:\Users\Admin\AppData\Local\Temp\a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1356
- C:\Windows\SysWOW64\DMe.exe
  "C:\Windows\system32\DMe.exe" C:\Users\Admin\AppData\Local\Temp\a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DMe.exe

Filesize
28KB

MD5
64cdbe318ab8921f4f797545fa28eaba

SHA1
c4884a6717dc010ff0af0735a078226734b80307

SHA256
a09ad657f4de428f42e5844008a2cfed68075ba4fa5413aeb6635cb0aa6d521f

SHA512
d5cc523260bc6b2fc30cbef932757fa062f41beffe98cdb0b2fdb0a34e4a980b9789c17f7c67281dbc68a0eff593bf1b8c2911cb31d5f563da5274264204927c

Download Submit
C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
27KB

MD5
4d10e39a848cafcfd43dae2c3b08fc76

SHA1
f7f54c4f10edccf8485557f1084371aa4c281900

SHA256
d7a978f790d128630a0bdf1816e95e45b8c1ba7d1488810ebecd6e2ef67b0106

SHA512
dc959d122c42d4530ac89866e09323ea301f5fb1070973fa1cb1d7e07d41f2d6bad92262675f661252e6e4ca789c4ba58472b55ace98778aab982dbba0a142f3

Download Submit
memory/1356-35-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-32-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-39-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-25-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-29-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-30-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-31-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-38-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-33-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-34-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-37-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-36-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2060-23-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5256-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5256-24-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download