Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/10/2026, 17:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
167.148.201.191_sample.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
167.148.201.191_sample.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 167.148.201.191_sample.msi
- Size 2.0MB
- Sample261015-v7mxvstz2m
- SHA256 3bada1269ff55b57a064b928c0b8f394d400df2837f93ecd59ad7e9f64ac3cfc
- MD5 0f8c4f0de445ff7765a89757a0ae086c
- SHA1 350001bf414c014fa24bb29b8d550d4bd0f08b64
- SHA512 c6ba06a2d53843f9c6e187537fea811e90b099fae733dc19a74bf6eb986b8c13648e30953837a5df958a4790cfc04abab0f14e922e051ddec552af61ad90978e
- SSDEEP 49152:ZrsTWI0oNlZyesa3vSOMluMqrqSzSS3InnnneX:eTq4Q8vahqrvOS3
- TLSH T1B4956D236A50600646B598FABEBD5E37695F7409101AD94EFFD34B86F12EBF80802D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4908 XeQMRgIO.exe 4852 XeQMRgIO.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 ipinfo.io 33 ipinfo.io - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4852 set thread context of 4184 4852 XeQMRgIO.exe 104 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI20A.tmp msiexec.exe File created C:\Windows\Installer\e59014e.msi msiexec.exe File opened for modification C:\Windows\Installer\e59014e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e590150.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{F92B1A5A-2C15-4579-8E9E-B3B5FD252A97} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2360 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname XeQMRgIO.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain XeQMRgIO.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1376 msiexec.exe 1376 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2360 msiexec.exe Token: SeIncreaseQuotaPrivilege 2360 msiexec.exe Token: SeSecurityPrivilege 1376 msiexec.exe Token: SeCreateTokenPrivilege 2360 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2360 msiexec.exe Token: SeLockMemoryPrivilege 2360 msiexec.exe Token: SeIncreaseQuotaPrivilege 2360 msiexec.exe Token: SeMachineAccountPrivilege 2360 msiexec.exe Token: SeTcbPrivilege 2360 msiexec.exe Token: SeSecurityPrivilege 2360 msiexec.exe Token: SeTakeOwnershipPrivilege 2360 msiexec.exe Token: SeLoadDriverPrivilege 2360 msiexec.exe Token: SeSystemProfilePrivilege 2360 msiexec.exe Token: SeSystemtimePrivilege 2360 msiexec.exe Token: SeProfSingleProcessPrivilege 2360 msiexec.exe Token: SeIncBasePriorityPrivilege 2360 msiexec.exe Token: SeCreatePagefilePrivilege 2360 msiexec.exe Token: SeCreatePermanentPrivilege 2360 msiexec.exe Token: SeBackupPrivilege 2360 msiexec.exe Token: SeRestorePrivilege 2360 msiexec.exe Token: SeShutdownPrivilege 2360 msiexec.exe Token: SeDebugPrivilege 2360 msiexec.exe Token: SeAuditPrivilege 2360 msiexec.exe Token: SeSystemEnvironmentPrivilege 2360 msiexec.exe Token: SeChangeNotifyPrivilege 2360 msiexec.exe Token: SeRemoteShutdownPrivilege 2360 msiexec.exe Token: SeUndockPrivilege 2360 msiexec.exe Token: SeSyncAgentPrivilege 2360 msiexec.exe Token: SeEnableDelegationPrivilege 2360 msiexec.exe Token: SeManageVolumePrivilege 2360 msiexec.exe Token: SeImpersonatePrivilege 2360 msiexec.exe Token: SeCreateGlobalPrivilege 2360 msiexec.exe Token: SeBackupPrivilege 332 vssvc.exe Token: SeRestorePrivilege 332 vssvc.exe Token: SeAuditPrivilege 332 vssvc.exe Token: SeBackupPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeRestorePrivilege 1376 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2360 msiexec.exe 2360 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1376 wrote to memory of 4888 1376 msiexec.exe 100 PID 1376 wrote to memory of 4908 1376 msiexec.exe 102 PID 4908 wrote to memory of 4852 4908 XeQMRgIO.exe 103 PID 4852 wrote to memory of 4184 4852 XeQMRgIO.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2360
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\cGcYgDUQ\XeQMRgIO.exe"C:\Users\Admin\AppData\Local\cGcYgDUQ\XeQMRgIO.exe" "C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi" ZihREZ85D12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\cGcYgDUQ\XeQMRgIO.exe"C:\Users\Admin\AppData\Local\cGcYgDUQ\XeQMRgIO.exe" --go "C:\Users\Admin\AppData\Local\Temp\167.148.201.191_sample.msi" "ZihREZ85D1"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe4⤵PID:4184
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59014f.rbs
- Size 8KB
- SHA256 0d88e546791c642972d5a3b73ff4e2fd5c2e34f5a7e593398ba1bee3dbd2b08e
- MD5 0c4a3e505a8d4254845dd740d38c1bb0
- SHA1 441f3be40bd7a84312d5d2049757a78da5bf7094
- SHA512 9b567005eadfbbaa9bf8d84fb4219b526148839ce492152a499e3369fb7bd62643245c98e1d8934ec928cb12c40f5759bbd6b30b505e9b9f9ae4ae5de37ab789
- SSDEEP 96:dmRsZ2yzvWJXZZTUorXPOCsTlzUorXPOC6je3H/U0sTl701zKINZxlMob4VzCGpz:AU23JAo7PtImo7Ptx3u+XGpA3W
- TLSH T1E00210017790D9E1E4DA2332CA5757253772F2DDCA05632F0A8EC2A44F23B9EEF4A195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SZA3OMON\144[1].bin
- Size 441KB
- SHA256 0fb96a7423cde141fd23d7ba6899051b4755e6fd8804db0fee9e72fc5c859aea
- MD5 19c9413b61bd07d24f5506903b753e33
- SHA1 e31cd322fcccc8e8edcde778ec96a6f81ea35fc5
- SHA512 a49d3f7a349d49b2f2c6b5da0809e7f097dc8a81cef2560872e4134ab8b73f6736ec5b92f86e6318fdd0ef9822e71fba49d5e7254e1b439173a6c43237cbf4a1
- SSDEEP 12288:iISRImObJoLM09KFS9vko8iHS4k0VaaWG:vLmSC9YS9vdRSn0D3
- TLSH T18EA4231A13F5D92B02622A88BE472DD1D98884A5E8C627FC37449FE310D63D9EC7A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cGcYgDUQ\XeQMRgIO.exe
- Size 19KB
- SHA256 53d3f24bbc3e95ba71da8480b8f8f07074f5ae1b2e20852b39845891bd942a37
- MD5 0187806eb04fa7279f016231fd1cc969
- SHA1 97fd62553d72891beeb4747f1a6cdfeff11fb193
- SHA512 cc1e8518e82d9fe5a661607d6b5d3a7a57b08003cc20a9164907df10c7069674b708bcbd5e03278af43886bf3c249d8a7b88b4b07528098095016e717b9543da
- SSDEEP 384:Ee8yBVHI1vhOkg6MNT5d8VNRXIkrd0outo874jWmwRWZ:EwByvwkKNT5+VNRXIid0vG87b0
- TLSH T18C921A0AA3E615FCC027D178C1FA6B32E5B1F821556B571E1630C2353E30AB4AF76B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590150.msi
- Size 2.0MB
- SHA256 3bada1269ff55b57a064b928c0b8f394d400df2837f93ecd59ad7e9f64ac3cfc
- MD5 0f8c4f0de445ff7765a89757a0ae086c
- SHA1 350001bf414c014fa24bb29b8d550d4bd0f08b64
- SHA512 c6ba06a2d53843f9c6e187537fea811e90b099fae733dc19a74bf6eb986b8c13648e30953837a5df958a4790cfc04abab0f14e922e051ddec552af61ad90978e
- SSDEEP 49152:ZrsTWI0oNlZyesa3vSOMluMqrqSzSS3InnnneX:eTq4Q8vahqrvOS3
- TLSH T1B4956D236A50600646B598FABEBD5E37695F7409101AD94EFFD34B86F12EBF80802D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 87eb4398339f99e3f4bf5f76f71330203f9873db2af04fe0b600497f7bac6209
- MD5 8d6cdfcaa67be0bba6e07b41284c774e
- SHA1 ab464b2412882a449396bae0a58ddddb08275a7a
- SHA512 9969718fcbb44a48db8462946fd9e8053ba916806de710fa7995bd0c5d9c265f461d9ce55b9a6da5f564662eb5c5ab7e72f203c65292451ecd4cf89b30aeecbb
- SSDEEP 24576:/u8m+1zqdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:W
- TLSH T1D047C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1cc1931d-61dd-4875-85d3-e5085f652cae}_OnDiskSnapshotProp
- Size 6KB
- SHA256 5e1130d769b82b1febc3e8a12d5353d831b3f36cfa8ad1a76b581f733f5a8374
- MD5 80ec896d12eedde3e32c0ce0040bd1b2
- SHA1 8569058ba9abfae2b7c73428df1e965e32408a83
- SHA512 fd531ded41b0bf3cf7bf6194967c1eb13b6c0ea5d5967e87c24a20b814d306420a0fc50ea8cface6809d68c9142dd5326bd7c7fcaad40f8b8bc79e8b5dc6fe8e
- SSDEEP 96:Fj+t0c5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:5+tFb++ZVmN
- TLSH T10BD1A9085AE54711E2F3AB7229F58557A877B911EF33CB8E0298238E2670910F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH