Analysis
- max time kernel
87s - max time network
81s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
qnbd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target qnbd.exe
- Size 4.2MB
- Sample261002-msbbhsxemd
- SHA256 cb093eecf19f1770ade4a191cfe95c42b39048cd68425a79a601e95a9935e888
- MD5 137c1f9c0039e6dea8a5b3e3a9b1ed18
- SHA1 22c1113d426941cfb3a6101e15d35aaeb6a489a6
- SHA512 e9553e22a62c87eb77fcf2b7213bb47e17cda6876bcdf3b9b13f998c8ba5c538cd15259c5709cc4105baf393b511d90d66fcd0f49289b5446f10679f52b4ec2d
- SSDEEP 49152:xfQFK2g+X3Q9ENhHKbGMMbcMyM2nngv0tQDxtImhy0AX8y5R9XoOy74BdKp9OMRW:OFK9NOAmX5hy1My5nXxc4qp/Rkl
- TLSH T1AB16F15A62A120ACC277C078CA8B5517EB7D741A07300AFB23E5C5992FB37F1657F21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1156 cmd.exe 448 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname qnbd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain qnbd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3412 qnbd.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe 3412 qnbd.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1156 3412 qnbd.exe 87 PID 1156 wrote to memory of 2136 1156 cmd.exe 88 PID 3412 wrote to memory of 448 3412 qnbd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\qnbd.exe"C:\Users\Admin\AppData\Local\Temp\qnbd.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0b && mode con: cols=90 lines=262⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\system32\mode.commode con: cols=90 lines=263⤵PID:2136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color f02⤵
- Executes a command shell one-liner
PID:448
-