qqpass | cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48

Resubmissions

28/03/2025, 07:23

250328-h8bj1as1fv 10

28/03/2025, 07:16

250328-h33fjaszg1 10

Analysis

max time kernel
120s
max time network
107s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Size

75KB
MD5

35aa48c51f67634ab9a05028ddacd91a
SHA1

41eda72d9456025eb0f881daac43f4b920fda1bd
SHA256

cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48
SHA512

5e3433d76ae896da6a91b66a49d15026620261eaab93acf498a0ea913eb5461bf44d7afae81dcebc878e04810da86fd3dea90d82eebbebfa75d3df7e1f1d3d4a
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOWWJ:GhfxHNIreQm+HidWJ

Score

10^/10

qqpass discovery persistence trojan

Malware Config

Extracted

Family

qqpass

http://www.zigui.org/article.php?id=103822

Attributes

url
http://www.mxm9191.com/myrunner_up.exe
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

QQpass
QQpass is a trojan written in C++..
trojan qqpass
Qqpass family
qqpass

Executes dropped EXE 1 IoCs

pid	Process
5132	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
File created	C:\Windows\SysWOW64\¢«.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
File created	C:\Windows\system\rundll32.exe	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1743146682"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1743146682"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5132	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
5132	rundll32.exe
5132	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 5132	5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe	81
PID 5616 wrote to memory of 5132	5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe	81
PID 5616 wrote to memory of 5132	5616	cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe	81

C:\Users\Admin\AppData\Local\Temp\cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe
C:\Users\Admin\AppData\Local\Temp\cd2b256127192a645cb0ee2f575bc480261bee0f5777b07fdf8fa23c6896cf48.exe bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
81KB

MD5
af615b4c408bef623b07a927b4401087

SHA1
09ca831814ee7f4eb2c54d0e3ed2629c47c197f2

SHA256
8f9823b17ef3651bcef42f2bde62b541892299fee58d061552d6e0c23581af8c

SHA512
7051509100afa7b2e7389573541e201023d47827df9b39b2a90bcb1db99fcab285f96649e1db7d55388ba92854e8ce25fdae37c61a00791cafd8538cb91ac013

Download Submit
C:\Windows\System\rundll32.exe

Filesize
78KB

MD5
19f24381e57d4f439d666597156d41a5

SHA1
838c54b426478814640b5eb69960592aea39c0ac

SHA256
9462a8c3eb30b444ff143b76f9c9bcc4132a2171294196a0ed215bccdf31982e

SHA512
0c3e25e534b98d986baff259641ee02f564ad0db685a79e28f0ba3f3e3e6db491b741cdb6f5dc652283951b34e9bc332931ed7b6be9748915a4953a061e98f98

Download Submit
memory/5132-14-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/5616-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/5616-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download