Analysis
- max time kernel
149s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
16/07/2025, 16:55
Behavioral task
behavioral1
Sample
ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe
Resource
win11-20250610-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe
- Size 82KB
- Sample250716-vffdpsysct
- SHA256 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6
- MD5 8b008952690d8f46d32634e1981e567e
- SHA1 7d82729bd1edb8580a3bfde44f9c7d52b916f298
- SHA512 fb12f1d8751272286fa929980360a9e5a35c75ba638b939181ca7d9ba11bb00bd5ebda0a4e188f444b22b74d7d0483b3673648c670dcdf5db7f2172bccd9434a
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO1:RshfSWHHNvoLqNwDDGw02eQmh0HjWO
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
qqpass
C2
-
http://www.zigui.org/article.php?id=103822
Attributes
-
url
http://www.mxm9191.com/myrunner_up.exe
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Signatures
- Qqpass family
- Executes dropped EXE 1 IoCs
pid Process 1588 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe File created C:\Windows\SysWOW64\¢«.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe File created C:\Windows\SysWOW64\notepad¢¬.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe File created C:\Windows\system\rundll32.exe ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1752684942" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1752684942" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1588 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 1588 rundll32.exe 1588 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3776 wrote to memory of 1588 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 78 PID 3776 wrote to memory of 1588 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 78 PID 3776 wrote to memory of 1588 3776 ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe"C:\Users\Admin\AppData\Local\Temp\ff6ac04036cdd50fd5a5afe5322d24b4cbaec9ced9e908e1c0aa85a85527bba6.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1588
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 81KB
- SHA256 942176622c818f5861a319c187b51dcf99abe80463b901c724af93586889f348
- MD5 227d51f727ff1eea143f45e487f87778
- SHA1 d19f12b487ad9536dc53174abf98dd83b1f36990
- SHA512 e8add17eb58481e1e727c4a9a07e8c570d236456ccce5414403644b40ed864711d86dba1522750aad2f023c9a1f099ff8c1b0d8ab117540fc3f59e0b3d58625e
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO3xyt:GhfxHNIreQm+Hi0xyt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 84KB
- SHA256 ddade27c72c3f4e881d2ee2057515d604a11ebd7674d009b308b18ff284f396f
- MD5 26149a29623b1a42af0299292c1a7fe2
- SHA1 ee9fd3711a4d287e653e8985d523502de20c7f94
- SHA512 8f1dec755ad412c4914eb60653b157561dc12db719ca682d73eaa737f2dccb408a819d9879176b5529c76678a9b47ca98ca6d8ce5cec9569379a76a285841053
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOkHNz87aw:GhfxHNIreQm+Hi3HNz87aw
- MD5 SHA1 SHA512 SSDEEP