Analysis
- user interaction
yes - max time kernel
33s - max time network
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Y8LIh1O5otkaA8FogfS9CT_qshb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
Y8LIh1O5otkaA8FogfS9CT_qshb.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
900 seconds
General
- Target Y8LIh1O5otkaA8FogfS9CT_qshb.exe
- Size 22.0MB
- Sample260730-hd4bjasene
- SHA256 11918d9589fbe67485c0c208372c1767c4abe82c6d94122bf239c1579651d3ee
- MD5 626bc5c22c662b5d5b982d6a0312101d
- SHA1 aaf0cf789fc2a5f957861ed85865add83510a1a0
- SHA512 2dd33ce2bc37c6b4438c8b1955378943bab1edfe9845ba55fee7266dbd4bfd6e44e64f13dfe256f62c7ce020bccdbdf1679cb67d6e856f4dfb398bb54c23f656
- SSDEEP 393216:BilhpFAl5nezJIdPAsKiuZqi+odepneorCTMD+R0/qflLg2LX0DGnKJeekA:BeclczJISszmaodelBrOLgu0qnKJeek
- TLSH T1CE3733D43AD0D26DC09AC435C28787F5F0936FD89EBA941BBFC609122570B96CCB2979
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: mountvol.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{784C4414-79F4-4C32-A6A5-F0FB42A51D0D}.cip Y8LIh1O5otkaA8FogfS9CT_qshb.exe File opened for modification C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{8F9CB695-5D48-48D6-A329-7202B44607E3}.cip Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5548 cmd.exe 2016 cmd.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe Token: SeDebugPrivilege 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3476 wrote to memory of 5548 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 89 PID 5548 wrote to memory of 444 5548 cmd.exe 91 PID 3476 wrote to memory of 2016 3476 Y8LIh1O5otkaA8FogfS9CT_qshb.exe 92 PID 2016 wrote to memory of 5736 2016 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Y8LIh1O5otkaA8FogfS9CT_qshb.exe"C:\Users\Admin\AppData\Local\Temp\Y8LIh1O5otkaA8FogfS9CT_qshb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "mountvol S: /s"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\system32\mountvol.exemountvol S: /s3⤵PID:444
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "mountvol S: /d"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\mountvol.exemountvol S: /d3⤵
- Enumerates connected drives
PID:5736
-
-