bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
Size 15.7MB
Sample260722-h1vmxaeq3s
SHA256 bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c
MD5 1c0f11dd788440a1eb7d1c00236e4551
SHA1 ba77a75a04d3af6b39ac5a5208cdf6cc77bd0bf8
SHA512 4c7f9532bddf82188f5e1519682479fd26fca196d757656d5032ba4c2499bf6e8dfd6a4c69c35fe05d1b9c2044c0a3a097c5a7160cd8b822bd6ebb51dfc1bae9
SSDEEP 393216:TpQDbvtSyNQadsI9Tq6yI1MAaJJGfNE4iuvYi1P:TUjtSyCaKWqhdQlEOd1P
TLSH
T162F633E129C86051F63E8E7DEAA0D1299423AF0C7A392B204E21F84676779FD53D171F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery execution persistence upx

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
1856	ujysystem.exe
5996	ujysystem.exe
3468	wimlib.EXE
4644	Qiibiosinfo.exe
3960	Qiibiosinfo.exe
2060	Qiibiosinfo.exe
888	QiiPECMD.exe
2552	cxdir.exe
760	cxdir.exe
4148	cxdir.exe
3124	cxdir.exe
1064	wimlib.EXE
744	wimlib.EXE

Loads dropped DLL 3 IoCs

pid	Process
3468	wimlib.EXE
1064	wimlib.EXE
744	wimlib.EXE

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\O:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\S:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\X:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\Y:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\B:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\I:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\J:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\M:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\P:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\T:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\A:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\H:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\L:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\N:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\U:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\V:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\G:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\K:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\Q:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\R:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\W:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\Z:	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
File opened (read-only)	\??\F:	QiiPECMD.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe
File opened for modification	\??\PhysicalDrive0	cxdir.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000246f6-157.dat	upx
behavioral1/memory/4644-159-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp	upx
behavioral1/memory/4644-161-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp	upx
behavioral1/memory/3960-164-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp	upx
behavioral1/memory/3960-163-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp	upx
behavioral1/memory/2060-167-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3216	cmd.exe
312	cmd.exe
2908	cmd.exe
1828	cmd.exe
3576	cmd.exe
5768	cmd.exe
5720	cmd.exe
3228	cmd.exe
2268	cmd.exe
1724	cmd.exe
1012	cmd.exe
636	cmd.exe
3240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujysystem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujysystem.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeBackupPrivilege	3468	wimlib.EXE
Token: SeSecurityPrivilege	3468	wimlib.EXE
Token: SeRestorePrivilege	3468	wimlib.EXE
Token: SeSecurityPrivilege	3468	wimlib.EXE
Token: SeTakeOwnershipPrivilege	3468	wimlib.EXE
Token: SeManageVolumePrivilege	3468	wimlib.EXE
Token: SeSystemEnvironmentPrivilege	4644	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	3960	Qiibiosinfo.exe
Token: SeSystemEnvironmentPrivilege	2060	Qiibiosinfo.exe
Token: SeBackupPrivilege	888	QiiPECMD.exe
Token: SeRestorePrivilege	888	QiiPECMD.exe
Token: 33	888	QiiPECMD.exe
Token: SeIncBasePriorityPrivilege	888	QiiPECMD.exe
Token: SeBackupPrivilege	1064	wimlib.EXE
Token: SeSecurityPrivilege	1064	wimlib.EXE
Token: SeRestorePrivilege	1064	wimlib.EXE
Token: SeSecurityPrivilege	1064	wimlib.EXE
Token: SeTakeOwnershipPrivilege	1064	wimlib.EXE
Token: SeManageVolumePrivilege	1064	wimlib.EXE
Token: SeBackupPrivilege	744	wimlib.EXE
Token: SeSecurityPrivilege	744	wimlib.EXE
Token: SeRestorePrivilege	744	wimlib.EXE
Token: SeSecurityPrivilege	744	wimlib.EXE
Token: SeTakeOwnershipPrivilege	744	wimlib.EXE
Token: SeManageVolumePrivilege	744	wimlib.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
1856	ujysystem.exe
1856	ujysystem.exe
5996	ujysystem.exe
5996	ujysystem.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 5768	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	85
PID 5768 wrote to memory of 1856	5768	cmd.exe	87
PID 1096 wrote to memory of 5720	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	92
PID 5720 wrote to memory of 5996	5720	cmd.exe	94
PID 1096 wrote to memory of 3228	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	99
PID 3228 wrote to memory of 3468	3228	cmd.exe	101
PID 1096 wrote to memory of 2268	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	102
PID 2268 wrote to memory of 4644	2268	cmd.exe	104
PID 1096 wrote to memory of 636	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	105
PID 636 wrote to memory of 3960	636	cmd.exe	107
PID 1096 wrote to memory of 1724	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	108
PID 1724 wrote to memory of 2060	1724	cmd.exe	110
PID 1096 wrote to memory of 3240	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	111
PID 3240 wrote to memory of 888	3240	cmd.exe	113
PID 1096 wrote to memory of 3216	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	114
PID 3216 wrote to memory of 2552	3216	cmd.exe	116
PID 1096 wrote to memory of 312	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	117
PID 312 wrote to memory of 760	312	cmd.exe	119
PID 1096 wrote to memory of 2908	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	120
PID 2908 wrote to memory of 4148	2908	cmd.exe	122
PID 1096 wrote to memory of 1012	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	123
PID 1012 wrote to memory of 3124	1012	cmd.exe	125
PID 1096 wrote to memory of 1828	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	126
PID 1828 wrote to memory of 1064	1828	cmd.exe	128
PID 1096 wrote to memory of 3576	1096	bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe	132
PID 3576 wrote to memory of 744	3576	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe
"C:\Users\Admin\AppData\Local\Temp\bd3846eeb62bffff4024737d900e466f0a2ce20f9b14e34852c8ac6c509aff2c.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Temp\UjyQii\ujysystem.exe
    C:\Temp\UjyQii\\ujysystem.exe /GetBan
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\ujysystem.exe /GetBan
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Temp\UjyQii\ujysystem.exe
    C:\Temp\UjyQii\\ujysystem.exe /GetBan
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismfdzcr\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE apply "C:\Temp\UjyQii\\dism.wim" 1 C:\Temp\UjyQii\dismfdzcr\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Temp\UjyQii\Qiibiosinfo.exe
    C:\Temp\UjyQii\\Qiibiosinfo.exe --sys
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Temp\UjyQii\QiiPECMD.exe
    C:\Temp\UjyQii\\QiiPECMD.exe SHOW F:-1
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Temp\UjyQii\\cxdir.exe" -mohong
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Temp\UjyQii\cxdir.exe
    C:\Temp\UjyQii\\cxdir.exe -mohong
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE info "" --extract-xml C:\Temp\UjyQii\\WimlibKQD.xml
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Temp\UjyQii\wimlib.EXE
    C:\Temp\UjyQii\\wimlib.EXE info "C:\Recovery\WindowsRE\Winre.wim" --header
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QiiImagex.EXE

Path C:\Temp\UjyQii\QiiImagex.EXE
Size 845KB
SHA256 3d68842a89267810e4fbfa73e57d4a6519ae3269190c066cfab3e7650542465e
MD5 dcd13e8935cd5a235d6d3124fc9d8bc2
SHA1 41426a7d1c5932ac6853186e41797f94c043e7dc
SHA512 c06569b6080161d26776cda16aadcb5b8c5038b1809d57bc5c6c016710736368ab4f658c6d7b71fbfafb945b045d69c5f89592b537a048458622e521da1f7c5e
SSDEEP 24576:JDfWvSKcol9bHYJkIefGEitR76/2apOBNZaTN:JDfWvSFol9bJIefDKlfapOUT
TLSH
T147054A1E73FC0069E5BBD6348A758262DAB1B8356730D6CF2190C57D5B27EE09938F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QiiPECMD.exe

Path C:\Temp\UjyQii\QiiPECMD.exe
Size 1.3MB
SHA256 4f31fe97180c161aacfa5b1900ceeec2073a20ebe6b33c0a2ae807cb09441565
MD5 99007d06809fc6e424490f02657cb1d6
SHA1 7bfb1077c82a08509360fbcf3e65b4799504d332
SHA512 5beb2bba290aab47fb4cc1a65ea12e8a0efb4965a25f0700db7f6de2cbd175ce6cb40cbe713d5bc551c484e8030da85b946e625200fcae0841000ea9ea153958
SSDEEP 24576:wZhuZxhpu8WR3En255kW38PNpuYkQIZKrnRvQTPxyw3EiE:Uhux7uH0AiZuvkrEywB
TLSH
T13F558D42F3A680D9D46FC5B5CB52563BFB703849C038976797A8CE622F33761A62D312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qiibiosinfo.exe

Path C:\Temp\UjyQii\Qiibiosinfo.exe
Size 163KB
SHA256 9b4f7ffa79f80af1bc81f5996562894f346ff20231af54082d68a75b0c3b9a40
MD5 16d6dffcdedb07cc5d904418116f7342
SHA1 2d2a4eae6812509278d0972dcf1d2bee92d4f862
SHA512 f0ffe189894a8468083349c49dd38f8ad543b29cb504f2a048d75b95971c6133ba3a75ed717c83ad26d98fbf238c7681ec2f9a7928840474175497f847c46749
SSDEEP 3072:Oyy8/KNOZll0sBX1xftZXOasQqr3L07xSxx:u8SNOCox/easEa
TLSH
T1BCF38D635B183F45D812AE34716B1F332AB58B3F2929C1E9F5AD8BB172706111F231B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxdir.exe

Path C:\Temp\UjyQii\cxdir.exe
Size 42KB
SHA256 301ccb6e3f8a5118d7882963715e215140f0b7528039cab3fcd7ace02a48da0d
MD5 2aa80509e9840822a3b6799a356efe90
SHA1 3dc558c97b209c91b7b45f90624f80c05c9094d0
SHA512 9d4e5f95ef444424857e55c345d56ac679005a0bdfddf59fb96f078a5913e7be5ba07cd16993878815dc9d2364d909f20d8b7d65b09bd2ec687622f5812c6bc2
SSDEEP 768:LyMt2rIk/q+RK0W48q59c9T3PeRToVuKgh:LyW29q+8q59srPVuj
TLSH
T1F0132A9AA35768FCCB2BC2788EE8063668B27C1113305AEF15F0FB311D01762656DB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.wim

Path C:\Temp\UjyQii\dism.wim
Size 3.1MB
SHA256 14e348aa7e8dcd4094993102a09e8309ea8f327d57febd73034b19f792cf6090
MD5 cd6a67b7fa1958f0b6879009f38c3e3b
SHA1 f92f534dd6c7ba3d9edd7bec292d0a489afbe50c
SHA512 225fc4d92976cc1236db77215a36a3a1977ac396c8146cd54a5984569483d3c96d6f345c07d961b5318d4d1dd85b1a7096cd091b2e5bce3a5cdbb774604109b8
SSDEEP 98304:nViK12NMRw60VVhVl8jlhQNj5qnn7Gf/YQ+ma:8UwMRw60hX8RhQz2n7GXYQla
TLSH
T14BE533F0FD81D1EFD9866CF927901AFB67B9223C359CE8865C193246383A22507576EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.exe

Path C:\Temp\UjyQii\dismfdzcr\X64\dism.exe
Size 329KB
SHA256 3c63ddb1e3f10ad6aa96ad7e35a080495e32cd748dbdbc0460f3f93beeee6b7f
MD5 f350e791f2ed95fb4a6fc50a0ea32b37
SHA1 472a3de24cd10913354798d51082d20fb166b2b1
SHA512 4b50aa71bec1aea7e18bd6b4c930942f513e2e8f55e7de217e5f7e19e0363f8f202dd75c9efb4a9b3f5046a90315a99614595ca13fffc4b3c80f9e2a44f5f51b
SSDEEP 6144:pRapj61OqCJqyOjAgEHj+WBRMQ8DlW2hWmrT:ij6oX5yARjCI2wo
TLSH
T12974C40A67FD0C54F5B3A6358AB28A019BB77CA15B31C3CF2184C23E1E67AD46D74B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwim-15.dll

Path C:\Temp\UjyQii\libwim-15.dll
Size 775KB
SHA256 dd6e34893bdc4719f7d24a7dfb438d4f2caf048a0a2123a840249432d854626f
MD5 6be0d3c865f445afc1210a79e1db7ca3
SHA1 99def6bccb1a32cf022ee574d1ef11a67d34c452
SHA512 a01bd43e8ba810973a884f534fcd931201423f2facfc2f5c48db9cefff0e680d8020be4bc771b22610937cf88fd2b33070d15e48ba2a07a319436dd78223869b
SSDEEP 12288:dFwFmPsspFIHKi+Ph5xmSy3XUlBAQqUfDx4HjXTOU:LwFQsyhdXsSy0lJZxwXOU
TLSH
T19BF46C03E3E210BCE1B7D2304A7B5772A932F8152930DE5E6658DB793F62E50872DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujysystem.exe

Path C:\Temp\UjyQii\ujysystem.exe
Size 833KB
SHA256 42a2c19262795cccc5dcb3c5ffd17bb2b07f5da5a8fda14f965deb9419140a2a
MD5 dec5ca26876a565fc8385e18cdf7146f
SHA1 44964b076be3c1f1d3b8f57553791fb7d9cf71dd
SHA512 efe166e3b481a1bac027c386853e7e6ab9e531e981e2bf74b513d1a81c17cafe75c0850211e72beacd3f514961b072e83ba17a886d7700a45e6352a84c50068e
SSDEEP 24576:M4G0PrI8DZprMIPpBAuCd3IQOHiBEA2DON:k0tFM0A3d3V+iBrAON
TLSH
T1E505F0E144906508F83B5E7DE696CE25841B6F0C3A3C23158E21F96033B71FA5BE692F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wimlib.EXE

Path C:\Temp\UjyQii\wimlib.EXE
Size 135KB
SHA256 102e24cb2e77b8354658924be1e9b2597cee215409539dfc2e19f14d3cd2b1a1
MD5 b31b05e78bc60474cc511974b8ebd63e
SHA1 48de3c65d7c5544b78322d32aaef8492c889a5f5
SHA512 0f25754551de7168494f78d1e3264a007177591d767662b1dfda80b4156cfedf2e9ea2f437e0b212197e9509b6cde06e2c80f550db42a321347eaf1a973bed32
SSDEEP 1536:BljjO84YthLCy9A+Ejq324ecJBvLoSc2t4ZafMW41u3Er5Vjmra7hNNE:vO85BAVjq3X/qktTYnNVj5NE
TLSH
T1DAD3FA01A3E620B8E5B796340DB74271AB33BC225638CE6D525CD6791F73D80AE25F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-189-0x00007FFB2D800000-0x00007FFB2D8EA000-memory.dmp

Download

memory/744-188-0x00007FF625540000-0x00007FF62556A000-memory.dmp

Download

memory/760-176-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1064-184-0x00007FFB2D890000-0x00007FFB2D97A000-memory.dmp

Download

memory/1064-183-0x00007FF625540000-0x00007FF62556A000-memory.dmp

Download

memory/1096-1-0x0000000002E7E000-0x0000000002E7F000-memory.dmp

Download

memory/1096-9-0x0000000002E7E000-0x0000000002E7F000-memory.dmp

Download

memory/1096-0-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1096-190-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1096-185-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1096-8-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1096-18-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1096-165-0x0000000000400000-0x0000000002E99000-memory.dmp

Download

memory/1856-13-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1856-11-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1856-6-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1856-7-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/2060-167-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp

Download

memory/2552-174-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3124-180-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3468-142-0x00007FF625540000-0x00007FF62556A000-memory.dmp

Download

memory/3468-143-0x00007FFB2D890000-0x00007FFB2D97A000-memory.dmp

Download

memory/3960-163-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp

Download

memory/3960-164-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp

Download

memory/4148-178-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4644-161-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp

Download

memory/4644-159-0x00007FF75C020000-0x00007FF75D7F1000-memory.dmp

Download

memory/5996-22-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5996-19-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5996-17-0x0000000000400000-0x0000000000630000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads