Analysis
- user interaction
yes - max time kernel
37s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
qnbd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target qnbd.exe
- Size 4.2MB
- Sample261002-msbbhsxemd
- SHA256 cb093eecf19f1770ade4a191cfe95c42b39048cd68425a79a601e95a9935e888
- MD5 137c1f9c0039e6dea8a5b3e3a9b1ed18
- SHA1 22c1113d426941cfb3a6101e15d35aaeb6a489a6
- SHA512 e9553e22a62c87eb77fcf2b7213bb47e17cda6876bcdf3b9b13f998c8ba5c538cd15259c5709cc4105baf393b511d90d66fcd0f49289b5446f10679f52b4ec2d
- SSDEEP 49152:xfQFK2g+X3Q9ENhHKbGMMbcMyM2nngv0tQDxtImhy0AX8y5R9XoOy74BdKp9OMRW:OFK9NOAmX5hy1My5nXxc4qp/Rkl
- TLSH T1AB16F15A62A120ACC277C078CA8B5517EB7D741A07300AFB23E5C5992FB37F1657F21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2852 cmd.exe 5652 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname qnbd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain qnbd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4100 qnbd.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe 4100 qnbd.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4100 wrote to memory of 2852 4100 qnbd.exe 90 PID 2852 wrote to memory of 4648 2852 cmd.exe 91 PID 4100 wrote to memory of 5652 4100 qnbd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\qnbd.exe"C:\Users\Admin\AppData\Local\Temp\qnbd.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0b && mode con: cols=90 lines=262⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\mode.commode con: cols=90 lines=263⤵PID:4648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color f02⤵
- Executes a command shell one-liner
PID:5652
-