55f9876aeb533dda4c1d115e4edebaeddab0ac4d8c8fa1a391d4f72831a0227c

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qcoin139.exe
Size 296KB
Sample260924-g3f2vsfg75
SHA256 55f9876aeb533dda4c1d115e4edebaeddab0ac4d8c8fa1a391d4f72831a0227c
MD5 e9726ea801251c54724da10f656b39cd
SHA1 8a902336994584ce5b65d8c78814f0a5737d7692
SHA512 fef0a1ab1068a7175703161201bd5d205eb589c314d0259eed433ea8cb9d8b06fbf8b7b193b9259ef50ce1f00b2957f3dec805e3f8b434cf32651bcbd3bea030
SSDEEP 3072:linxucnLORM7jlHNZd7JBTr7V62lGounYxIgtKcLZl1x4oFF8QbJ4N4Ot87oYXiT:c/nCRCbTunY+jcvPF8Eg02gQ0
TLSH
T1A9546C1C62CA6B31C3BF9739CAE64414CB75A8135246E34E394C64A46F73360DA62F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	3392	QUpdate.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3392	QUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
3392	QUpdate.exe
5092	qcoin139.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/files/0x000e00000001c4bb-19.dat	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcoin139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qcoin139.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4976	qcoin139.exe
4976	qcoin139.exe
4976	qcoin139.exe
4976	qcoin139.exe
3392	QUpdate.exe
3392	QUpdate.exe
3392	QUpdate.exe
5092	qcoin139.exe
5092	qcoin139.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	qcoin139.exe
Token: SeDebugPrivilege	3392	QUpdate.exe
Token: SeDebugPrivilege	5092	qcoin139.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3392	4976	qcoin139.exe	88
PID 3392 wrote to memory of 5092	3392	QUpdate.exe	89

C:\Users\Admin\AppData\Local\Temp\qcoin139.exe
"C:\Users\Admin\AppData\Local\Temp\qcoin139.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\QUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\QUpdate.exe" qcoin139
  2⤵
  - Downloads MZ/PE file
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\qcoin139.exe
    "C:\Users\Admin\AppData\Local\Temp\qcoin139.exe" auto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\QUpdate.exe
Size 74KB
SHA256 e3be1ae3945fcc1687d15ce1c46e372304a0bb7667809d95bc7b48333b0b90db
MD5 f96dc907169162be1b54aaf72089a718
SHA1 6cc8bee3bdb299ab187521b76d2556d1725b00d1
SHA512 ccdaa50730af45e609780850172928bff0881bcfeb95faac5a76cfd1764a874e2f31aa17402350fb24379de745448ca3f66884cf1c2d2cee6238f82bfe1697dc
SSDEEP 1536:lQ02ecFb4N4Ot87oYXiUFOg7IOvMBKBbNYTpWsT12BT12v:lQbJ4N4Ot87oYXiUFOgU+DbNYTwsZuZm
TLSH
T11F734C39339E9633CAAE17BC50A642A407B0FD65B732E78E1D8172E84FB77405642393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcoin139.exe

Path C:\Users\Admin\AppData\Local\Temp\qcoin139.exe
Size 298KB
SHA256 737d0e06fba04380fe039e1bc55bafa3e03c0dc5759e29c40a1904d87ced0e35
MD5 48cd2ca637f13b2e85895e66cb1357d6
SHA1 742139a23cc2c5f6a3e96ee06f26d3312cc2fa61
SHA512 433fe4ec9cefc1f9afce735dcb5c50fc1cef87ffe3dfba5f893ba1db9bebfa04e4d5f3130e59337c2061359e170851d2558ca8056b224c1fa67d1c0072c56786
SSDEEP 3072:1kzVJqEKUqRXw9gIOcbb9+aTxJwGI/jSPKIcLZl1x4oFF8QbJ4N4Ot87oYXiUFO7:1uUPRXweI5wGI7qcvPF8Eg02gQ0
TLSH
T1F5546B4C638E6A31D3FB873D8BA28404CB74B8135645D34E358CA5986F73351DA62F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3392-12-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/3392-13-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/3392-14-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/3392-28-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/4976-0-0x00000000015E0000-0x00000000015F0000-memory.dmp

Download

memory/4976-1-0x0000000074A52000-0x0000000074A54000-memory.dmp

Download

memory/4976-7-0x00000000015E0000-0x00000000015F0000-memory.dmp

Download

memory/5092-26-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/5092-27-0x0000000074A50000-0x0000000075071000-memory.dmp

Download

memory/5092-29-0x0000000074A50000-0x0000000075071000-memory.dmp

Download