quantum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
quantum.exe
Size 4.0MB
Sample260722-2flztada36
SHA256 105d10f58127c4eeee54a53d3bf3d79d2561d8ee99a6628307ff82e3f2067ed5
MD5 a33f9037192347f51d452c54ec03d613
SHA1 0b13f13c6e83f3301caa5f557dae4d7cd01ed200
SHA512 676fb302895dae932b5eb7103700cdf85c35b94bd963cffa28f40dcd3e0f6c993d3fe91772bd8cb76e95494612a57c68211dc18d813d7be62ef9adbe947683d7
SSDEEP 98304:m0dLh0v/yvjKYOfEfhlV5uEDVoqldr2M3:5h0o23EfDPBVoqr2M3
TLSH
T14716F143F75582BAC526957886A6C326F779B880032587CF37A91B352F533E11F3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
quantum.exe

File Explorer

quantum.exe

.exe 4.0MB

quantum.exe

IMPHASH 675e6debc3f42a48ca78e5e808e455e3
SHA256 105d10f58127c4eeee54a53d3bf3d79d2561d8ee99a6628307ff82e3f2067ed5
MD5 a33f9037192347f51d452c54ec03d613
SHA1 0b13f13c6e83f3301caa5f557dae4d7cd01ed200
SHA512 676fb302895dae932b5eb7103700cdf85c35b94bd963cffa28f40dcd3e0f6c993d3fe91772bd8cb76e95494612a57c68211dc18d813d7be62ef9adbe947683d7
SSDEEP 98304:m0dLh0v/yvjKYOfEfhlV5uEDVoqldr2M3:5h0o23EfDPBVoqr2M3
TLSH
T14716F143F75582BAC526957886A6C326F779B880032587CF37A91B352F533E11F3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

719504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Downloads\speed\phantom perm and temp - Copy (2)\speed perm and temp\permtemp\x64\Release\quantum.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

FreeLibrary QueryPerformanceCounter GetCurrentThreadId Sleep CloseHandle GetCurrentProcessId CreateProcessA GetModuleHandleW GlobalUnlock UnmapViewOfFile MapViewOfFile WideCharToMultiByte GetProcAddress HeapAlloc ReadFile GetFileSizeEx CreateFileA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetLastError LocalFree QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapFree GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CreateFileMappingA ReleaseSRWLockExclusive

user32

SetClipboardData GetCursorPos GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow MessageBoxA BlockInput GetKeyState GetMessageExtraInfo GetClipboardData EmptyClipboard ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout IsWindowUnicode ReleaseCapture GetForegroundWindow LoadCursorW SetCapture SetCursor GetWindowRect GetClientRect MoveWindow CloseClipboard SetCursorPos OpenClipboard

advapi32

GetUserNameA

shell32

ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SysAllocString VariantClear SysFreeString

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset memchr memcmp __C_specific_handler __current_exception longjmp __intrinsic_setjmp _CxxThrowException strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context strrchr

api-ms-win-crt-math-l1-1-0

powf __setusermatherr cosf acosf fmodf sqrtf ceilf sinf roundf

api-ms-win-crt-string-l1-1-0

strncpy strlen strcmp strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

fgetpos _set_fmode setvbuf ungetc fgetc fputc __p__commode fsetpos _fseeki64 __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen _get_stream_buffer_pointers fwrite __stdio_common_vfprintf fseek fflush ftell fclose __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _register_thread_local_exe_atexit_callback _c_exit _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type system _get_narrow_winmain_command_line _initterm

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale