Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/04/2026, 08:29
Behavioral task
behavioral1
Sample
321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe
- Size 73KB
- Sample260426-kdpt9aa16x
- SHA256 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc
- MD5 73a5e1190b18b66a87e9b0bf58936951
- SHA1 e2124d8683c60b4f063c5ed8c184ae45d9e8ff13
- SHA512 bfd938abec017b05701304641c1315a712657f0758c7861f27570175b993e56b856ad35e7df8dfc820ee168b12bdbb1d6e1f23c0236e11bbb7d1574421cfd8f9
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO:RshfSWHHNvoLqNwDDGw02eQmh0HjWO
- TLSH T1BE735B9F74D488BDFC2452B0146B1BB18577AA40123A9BCB3BA8CD7D953B1275B3C283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
qqpass
C2
-
http://www.zigui.org/article.php?id=103822
Attributes
-
url
http://www.mxm9191.com/myrunner_up.exe
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1452 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe File created C:\Windows\SysWOW64\¢«.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe File created C:\Windows\system\rundll32.exe 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1777192161" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1777192161" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1452 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 1452 rundll32.exe 1452 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1452 4792 321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe"C:\Users\Admin\AppData\Local\Temp\321c9b9429478b1ba79beb06be9a693365ace236976cf14d3194c273b5d38dcc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 78KB
- SHA256 dee660743bd66c85d799e1773afc1d3c178bd1e0e59d2f82a52fea229dc55901
- MD5 6a126b9db2a5642e730e22e40520a9e1
- SHA1 a8d74e83694251d01c08b6901a614cd892a24c80
- SHA512 ceb1b19f20793177bdd65afb9a0f9f84689897246255126836cae965ccb0237a5c0c440cb94b604a58e6488e55fcbd90baab8248795a8cdb4d26cb83f07e873c
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOpwaNm:GhfxHNIreQm+HiMwaNm
- TLSH T19B734A9F70D544B9F83456B025AA07F28577BA50023A5BCF3B98CE79A53E1365B3C283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\rundll32.exe
- Size 80KB
- SHA256 7b9cc92cc58ce7843873b064f1be31f281a873185f515cd19e5c6c3897cf1f2c
- MD5 cbd8745a98ca8e050a50b9f9578a2055
- SHA1 49effd667ecdbe40327d7289cc3bf14c4fffdce8
- SHA512 4df75561dc45ae0b6ab126b95c9211fd48a4c62292efd5ae277ee177bfb5b64a790efe0f1e9ab3ee30fa2e3d01c673dd900135b8a0f1d0ada48bec672c6cea6a
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO06WTlgtFl8:GhfxHNIreQm+Hix6WTlgtFl8
- TLSH T1C9834A9F70D584B9F83452B029AA17F2C523B55012365BCF3B98CF79753A1366B2D283
- MD5 SHA1 SHA512 SSDEEP TLSH