fasong | 1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Size 841KB
Sample260901-lsf2bszva1
SHA256 1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1
MD5 837e0ca07599b94d1ee5a8503009084e
SHA1 a6cc3c3fede95c56576dca7124f4926b365312f0
SHA512 9e0f6a5caf54a3497452a5de14b77436287c514659f11eff868f6443754cdf3473573778846d7c14e5d64773929b2335aba75078665b7eaa66a29ea453a7e27e
SSDEEP 12288:s8kxNhOZElO5kkWjhD4AIpG6GtAtScw3qEKBYG:DqEkfF/145
TLSH
T10905CF2AF3D08833D2631A78CD578768AC26BE903E2955423BF82E4D5F7D35178263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery fasong persistence upx worm

Malware Config

Signatures

Family: Fasong
Fasong is a Windows worm written in Delphi.
worm fasong

Detects Fasong 13 IoCs

resource	yara_rule
behavioral1/memory/4796-0-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/4796-3-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/files/0x00020000000233b6-11.dat	family_fasong
behavioral1/files/0x00100000000231f3-19.dat	family_fasong
behavioral1/memory/4992-21-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/4992-22-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/4796-23-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/files/0x00020000000233b3-25.dat	family_fasong
behavioral1/memory/1524-26-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1524-27-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/4980-29-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/4980-30-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1524-31-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong

Executes dropped EXE 3 IoCs

pid	Process
4992	YWURQB.EXE
1524	QMH.EXE
4980	YWURQB.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YWURQB.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "F:\\$RECYCLE.BIN\\REALPRU.EXE \"%1\" %*"	YWURQB.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QQFZJ.EXE = "C:\\System Volume Information\\QQFZJ.EXE"	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	YWURQB.EXE
File opened (read-only)	\??\S:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\V:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\H:	YWURQB.EXE
File opened (read-only)	\??\M:	YWURQB.EXE
File opened (read-only)	\??\P:	YWURQB.EXE
File opened (read-only)	\??\N:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\G:	YWURQB.EXE
File opened (read-only)	\??\N:	YWURQB.EXE
File opened (read-only)	\??\E:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\M:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\Q:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\K:	YWURQB.EXE
File opened (read-only)	\??\T:	YWURQB.EXE
File opened (read-only)	\??\G:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\J:	YWURQB.EXE
File opened (read-only)	\??\H:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\I:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\K:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\U:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\I:	YWURQB.EXE
File opened (read-only)	\??\U:	YWURQB.EXE
File opened (read-only)	\??\V:	YWURQB.EXE
File opened (read-only)	\??\O:	YWURQB.EXE
File opened (read-only)	\??\R:	YWURQB.EXE
File opened (read-only)	\??\J:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\P:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\R:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\Q:	YWURQB.EXE
File opened (read-only)	\??\S:	YWURQB.EXE
File opened (read-only)	\??\L:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\O:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\T:	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
File opened (read-only)	\??\E:	YWURQB.EXE

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4796-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/4796-3-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x00020000000233b6-11.dat	upx
behavioral1/files/0x00100000000231f3-19.dat	upx
behavioral1/memory/4992-21-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/4992-22-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/4796-23-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x00020000000233b3-25.dat	upx
behavioral1/memory/1524-26-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1524-27-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/4980-29-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/4980-30-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1524-31-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YWURQB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YWURQB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QMH.EXE

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\PerfLogs\\QMH.EXE %1"	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\System Volume Information\\QQFZJ.EXE \"%1\" %*"	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "F:\\$RECYCLE.BIN\\REALPRU.EXE \"%1\" %*"	YWURQB.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\System Volume Information\\QQFZJ.EXE %1"	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\XYKDMH.EXE \"%1\""	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\PerfLogs\\QMH.EXE %1"	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\$Recycle.Bin\\IEB.EXE \"%1\""	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YWURQB.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4992	YWURQB.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4992	4796	1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe	84
PID 1524 wrote to memory of 4980	1524	QMH.EXE	89

C:\Users\Admin\AppData\Local\Temp\1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe
"C:\Users\Admin\AppData\Local\Temp\1ff1a043d6baa5a79431a587079d98cefb329243ce17085725d8b87174c5a3e1.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\YWURQB.EXE
  C:\Users\YWURQB.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4992

C:\PerfLogs\QMH.EXE
C:\PerfLogs\QMH.EXE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\YWURQB.EXE
  C:\Users\YWURQB.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QMH.EXE

Path C:\PerfLogs\QMH.EXE
Size 841KB
SHA256 4a9778a1cc88d2819d4f29f908b9910c86e254235e6093ca8229ab7d0a06f389
MD5 4474a8c5c1bee5510a11267fac05ec7c
SHA1 a8d33de3387e26626f964047315c8f70067ac973
SHA512 538aa569d83032ce6840cb736b616d7ec139f131a916b58df65df2ebec197182a6e72263b3f8d4a614fbf3f1341a40a1a05011ef18ea8af29dd0dfb00fe86b26
SSDEEP 12288:s8kxNhOZElO5kkWjhD4AIpG6GtAtScw3qEKBYG:DqEkfF/145
TLSH
T1E705CF2AF3D08833D2631A78CD578768AC26BE903E2955423BF82E4D5F7D35178263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XYKDMH.EXE

Path C:\Users\XYKDMH.EXE
Size 841KB
SHA256 fd6c14c742d347d21def3bb052c124ff3b9a8147306cfe1409748b4c88213b66
MD5 7792e0db05c935e51e5bc8030741134f
SHA1 2d73b022d086d8d2192d0614f49e97436a1a3595
SHA512 f2389dabd6c4ec2de2c434ad755951cfed81def1623bf82a1704f94b1322dfa7f5038bfc64f131bebb3654f7bf53c5e170039fb888a3a67f14b3b284d5f341f4
SSDEEP 12288:s8kxNhOZElO5kkWjhD4AIpG6GtAtScw3qEKBYG:DqEkfF/145
TLSH
T1CA05CF2AF3D08833D2631A78CD578768AC26BE903E2955423BF82E4D5F7D35178263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YWURQB.EXE

Path C:\Users\YWURQB.EXE
Size 841KB
SHA256 a66ebb4a6bce46a56ed7748251056baa6867444b631f0554ba583b36ecbcf973
MD5 3a4f0f937e2e272836e5458c8ffc07f7
SHA1 e28841de3c240ccac0fba46d9ff65a98bd8a8cc5
SHA512 6a120dd005a9a7803c129913a683fe634cc481fff997c61010e40655a8e147d407dfd2fcdb0cc35818a2605b4096c9cec440c1a61480cb213843366762490706
SSDEEP 12288:s8kxNhOZElO5kkWjhD4AIpG6GtAtScw3qEKBYG:DqEkfF/145
TLSH
T15E05CF2AF3D08833D2631A78CD578768AC26BE903E2955423BF82E4D5F7D35178263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filedebug

Path \??\c:\filedebug
Size 279B
SHA256 d109c0cc909d938e3b5cd6adbeaa4993a622acd37df9f425d4df192359476d0f
MD5 bd472b9be5319787f57a468f794f59b5
SHA1 2693486613394af971cbcf908080e686b0ae879c
SHA512 24ccec60dc77ecf69812335ca913c44dd7f6fe9434c6d1bacd4a24f14caab4b20938880cbd0a155dcf40f8a4a0d812b263f334659f270419387732dad9258224
TLSH
T13ED08CDEE708CE4C2B022F1361E0DA2A3AA809C9A10C618DCF9904C69C15AD61367E40
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1524-26-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1524-27-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1524-31-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4796-23-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4796-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4796-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4796-1-0x000000000045A000-0x000000000045B000-memory.dmp

Download

memory/4980-29-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4980-30-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4992-21-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4992-22-0x0000000000400000-0x0000000000470000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads