afdae55082bf60e13c9dd41fe100660c71c7dbfbbe9ca2f40405563fa8954b58

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-2tx91af18t
SHA256 afdae55082bf60e13c9dd41fe100660c71c7dbfbbe9ca2f40405563fa8954b58
MD5 7af85232cddb268f71390d23f50dac93
SHA1 1686b582466e4aa39a276298906338f5501fa0fa
SHA512 e938d85fd92bb3dce568172a9f6ff4bae3b04ba021bc6111dfc9f35d64420e057aca18a2c875f1b14dabf79b9ca9151b62ed9543a5d222324244882f0598853d
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAe:6ukQmH0HmKxofM3nl6UfMYrLgAe
TLSH
T1C5876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\QPM8n3 = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4084	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6120	mPbdNQ.exe
476	mPbdNQ.exe

Loads dropped DLL 4 IoCs

pid	Process
6120	mPbdNQ.exe
6120	mPbdNQ.exe
476	mPbdNQ.exe
476	mPbdNQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\QPM8n3\\mPbdNQ.exe\""	mPbdNQ.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1120	cmd.exe
2120	cmd.exe
4852	cmd.exe
4540	cmd.exe
1196	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	mPbdNQ.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QSox3G\XPSPLOG.dll	mPbdNQ.exe
File created	C:\Program Files (x86)\QSox3G\image.png	mPbdNQ.exe
File opened for modification	C:\Program Files (x86)\QSox3G\image.png	mPbdNQ.exe
File opened for modification	C:\Program Files (x86)\QSox3G	mPbdNQ.exe
File created	C:\Program Files (x86)\QSox3G\thumbs.db	mPbdNQ.exe
File opened for modification	C:\Program Files (x86)\QSox3G\QSox3G.exe	mPbdNQ.exe
File opened for modification	C:\Program Files (x86)\QSox3G\XPSPLOG.dll	mPbdNQ.exe
File opened for modification	C:\Program Files (x86)\QSox3G\thumbs.db	mPbdNQ.exe
File created	C:\Program Files (x86)\QSox3G\QSox3G.exe	mPbdNQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
616	cmd.exe
5712	cmd.exe
1428	cmd.exe
4332	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mPbdNQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mPbdNQ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5984	schtasks.exe
2908	schtasks.exe
5172	schtasks.exe
2052	schtasks.exe
3428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
4408	install.2.0.02.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe
6120	mPbdNQ.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeIncreaseQuotaPrivilege	4084	powershell.exe
Token: SeSecurityPrivilege	4084	powershell.exe
Token: SeTakeOwnershipPrivilege	4084	powershell.exe
Token: SeLoadDriverPrivilege	4084	powershell.exe
Token: SeSystemProfilePrivilege	4084	powershell.exe
Token: SeSystemtimePrivilege	4084	powershell.exe
Token: SeProfSingleProcessPrivilege	4084	powershell.exe
Token: SeIncBasePriorityPrivilege	4084	powershell.exe
Token: SeCreatePagefilePrivilege	4084	powershell.exe
Token: SeBackupPrivilege	4084	powershell.exe
Token: SeRestorePrivilege	4084	powershell.exe
Token: SeShutdownPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeSystemEnvironmentPrivilege	4084	powershell.exe
Token: SeRemoteShutdownPrivilege	4084	powershell.exe
Token: SeUndockPrivilege	4084	powershell.exe
Token: SeManageVolumePrivilege	4084	powershell.exe
Token: 33	4084	powershell.exe
Token: 34	4084	powershell.exe
Token: 35	4084	powershell.exe
Token: 36	4084	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 4084	6120	mPbdNQ.exe	92
PID 6120 wrote to memory of 1120	6120	mPbdNQ.exe	94
PID 1120 wrote to memory of 2052	1120	cmd.exe	96
PID 1120 wrote to memory of 3952	1120	cmd.exe	97
PID 1120 wrote to memory of 6064	1120	cmd.exe	99
PID 6120 wrote to memory of 2120	6120	mPbdNQ.exe	103
PID 2120 wrote to memory of 3428	2120	cmd.exe	106
PID 6120 wrote to memory of 4852	6120	mPbdNQ.exe	107
PID 2120 wrote to memory of 5908	2120	cmd.exe	109
PID 4852 wrote to memory of 5984	4852	cmd.exe	111
PID 6120 wrote to memory of 4540	6120	mPbdNQ.exe	112
PID 2120 wrote to memory of 5564	2120	cmd.exe	114
PID 4852 wrote to memory of 3624	4852	cmd.exe	115
PID 4540 wrote to memory of 2908	4540	cmd.exe	116
PID 4540 wrote to memory of 4872	4540	cmd.exe	117
PID 4852 wrote to memory of 1432	4852	cmd.exe	119
PID 4540 wrote to memory of 3052	4540	cmd.exe	120
PID 6120 wrote to memory of 1196	6120	mPbdNQ.exe	121
PID 1196 wrote to memory of 5172	1196	cmd.exe	123
PID 1196 wrote to memory of 1296	1196	cmd.exe	125
PID 1196 wrote to memory of 2184	1196	cmd.exe	127
PID 4332 wrote to memory of 6016	4332	cmd.exe	132
PID 616 wrote to memory of 2104	616	cmd.exe	133
PID 1428 wrote to memory of 5192	1428	cmd.exe	135
PID 5712 wrote to memory of 4832	5712	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4408

C:\Users\Public\QPM8n3\mPbdNQ.exe
"C:\Users\Public\QPM8n3\mPbdNQ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QPM8n3\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QPM8n3\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2184
- C:\Program Files (x86)\QSox3G\QSox3G.exe
  "C:\Program Files (x86)\QSox3G\QSox3G.exe"
  2⤵
  PID:2684

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QPM8n3" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QPM8n3" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6016

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4876

C:\Users\Public\QPM8n3\mPbdNQ.exe
"C:\Users\Public\QPM8n3\mPbdNQ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2104

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4832

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QSox3G.exe

Path C:\Program Files (x86)\QSox3G\QSox3G.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\QSox3G\XPSPLOG.dll
Size 3.3MB
SHA256 f9c2b1759dccbdd9fb9ffc77a8e5397f7476cc93b8338d49bdc0870c094ae7da
MD5 467aa12a71fcba7700948f585cc02c5b
SHA1 b36773245fc8396f31fa342ac7c52a47a87c145d
SHA512 c3ba9fa4b18813b4bd33ff9726cee5bf10f60736605439333e2cac609fb3956338b66ee3fb74808fe07e012cb4d42f3124c5ca796a310e5f7f23010f33ec27e5
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT150:yCMWmcKfST5t+BceThTHfaCCUqmJP0
TLSH
T1C1F53349BBCB921EE55272B84F7DFC7E767C19C8430CEC88D4A5314B90A6B69503DA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\QSox3G\XPSPLOG.dll
Size 2.3MB
SHA256 95b466ec6d902d93e0abce1fa1511c6382a854bc28ed8d29ec5085060dd58d27
MD5 9e874b8dff9acfa45eb8a4ad55f9fb13
SHA1 ae8210e1f3d3cf05d4021ec70fb91e1b5418d7ca
SHA512 17c7462dcb0c581b5a2b449d3e472a2ab86ad3e11823c6c4f19e856ab87bfdbee9466eaf1c90244ba46c26624b6284a0cf73edcb57627e8146e7780f46904d7f
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nED:yCMWmcKfST5t+BceThTz
TLSH
T1EEB5339BF59B461EEA6133792F8DEC9D72FD49C8822DE548D4E2704F4010B6E903E68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 089302c59c0c53a4597352965e63aacac5951085fefef95465f46dad7e1360ac
MD5 555f855df098260cce7b30887b745041
SHA1 b759d27e33ae5bc7c7fa93c59cad33cc77c19590
SHA512 ffeca9c8860200c628a1911712bbe118cfcaecd1ca9c4f5527acc2d0fd397567a73e1e3890ded729f9d29c53cc8268e8d5ad78deb13bad61c8cec3b8d54773c8
TLSH
T1483199BB1F6C79C78F7A8DA425C9F1312DF8A2905CD5185E0165C478AF4C3B22F5990D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 91fe9324af68c0ddf69e243b3944509c3eb664735648087815e844073ec55950
MD5 5b2a3852957f0a78c119a0af4d9137d4
SHA1 61f1529553f5a4401b79c274a6c4a5047074ce23
SHA512 47c0debf0ba169a91ec6283a60ae2d4c4e1946ce76546c58d0704c5a0af3d718ef7b8e6a4040ad01865815f74cdbfb9dc86a211ed3566e42c2e65273396fe9d8
TLSH
T15D31F6574E785403DF0C5FB866D0E6377CF1B2784CA84806603EC2AB9625B776F85000
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 80b3ff0c67d8b0abca74d9e211d410f93829eedda5896a01298742f1d3396ab3
MD5 5a9cdfc85f46a8b4f29d4fe2d12032a3
SHA1 77d4c9607d546335ae9336c4fe6d69d7dbfe6908
SHA512 21e565d67e37252a14d965ef14592ccb2e91d852d639362bf5220e4d3ac4f3ce2d9c9ea91696749c123f167480c1f92017c5e4408d67b8ca09a06bc79f107128
TLSH
T169F0272809BC823CF137E97A86CA39DB0DAEF607140685A80AA9474DA516D122E91579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4d27d3543ebdcecd9bbb84dd26e4aac4a4f2f0bfdcaee285648bca0008ce08ab
MD5 cbc3baba92c00719252e86a43dea410a
SHA1 682512aa046a89c70412716932ce2151c3b02059
SHA512 f7351a0eea46c5e8d55a4908d90119e3be0527a6647ee5f43e46b5afa4b6075d2a5f660e2e1c98ab002a0ff808dfe23dc4825e71b85f0134956ed40c56237ec7
TLSH
T168F0272D52EA426FF13B86B846C6BA628EAAE522001652AD0AFD03C41E54C416C8263D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yywfstl1.aex.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yywfstl1.aex.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\QPM8n3\UxEnhance64.dll
Size 3.1MB
SHA256 854dd497f02cfdac7120d3efce017a916cf8d9b6674f486028d97f167adde32b
MD5 ed23e7f0a9a72a81fe62bd315779e280
SHA1 05aaeba25c5733cb0a7158e14f192d03ba45c996
SHA512 ec3f881d79e978c9353ee105838ada39b57d6aa1882fb164486652f8068f14d2c219d9157e3e296741482c116f29513318257b1ce9ca537fc90bc1e224bf4731
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+A:P9m29xx3Tiqt06ox6+z2rNNrKoA
TLSH
T1AEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\QPM8n3\adoresd.dat
Size 4.8MB
SHA256 bac222e1c8e7c1694ce46ccd07df4979887449e011d4c85ae8d1d4fe42ae179b
MD5 2215dfdbd72732091328666e35d6b435
SHA1 77a2eb8eb3aaffa551c02b897471c99655ef97df
SHA512 824b674a8beda4c014612e250b41e25d4a47503750130871d3fab3a72d6c83efa13f41be6797ecb70e42535c1311506a6c901e47804d4445cc90c95ed9db8994
SSDEEP 98304:EWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:EWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1AF3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mPbdNQ.exe

Path C:\Users\Public\QPM8n3\mPbdNQ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\QPM8n3\msadox.tb
Size 8KB
SHA256 1730da0df84e37289ccd9d4e85c58803f944f5be4a2bcb3503034d880d567959
MD5 99453554d61d49b84cb1f40698458537
SHA1 d543b654c4f58d0b3528eb98247896a1d9a31c0a
SHA512 d1901e9f1e2283cdd378393dbbe3c591b33cc0566ece8cd97042cf44fcc1d9bf1a731c5a52aa74cf1f36a66deea0af2fee1ab8423b390df4224a1a219d1361a7
SSDEEP 192:pqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:psZqZOXQ3uqvR2Kfzp
TLSH
T147029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-594-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/476-597-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/476-583-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download

memory/476-587-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/476-589-0x00007FFA5FE60000-0x00007FFA5FE62000-memory.dmp

Download

memory/476-591-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/476-584-0x0000027566CA0000-0x00000275671BE000-memory.dmp

Download

memory/476-595-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/476-601-0x0000027566CA0000-0x00000275671BE000-memory.dmp

Download

memory/476-600-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download

memory/476-599-0x0000027569480000-0x0000027569D57000-memory.dmp

Download

memory/4084-605-0x000001A57F450000-0x000001A57F472000-memory.dmp

Download

memory/4084-609-0x000001A57F4A0000-0x000001A57F4BE000-memory.dmp

Download

memory/4084-610-0x000001A57F4C0000-0x000001A57F572000-memory.dmp

Download

memory/4084-611-0x000001A57F580000-0x000001A57F58A000-memory.dmp

Download

memory/4408-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4408-525-0x00007FFA48770000-0x00007FFA48782000-memory.dmp

Download

memory/4408-524-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4408-504-0x00007FFA48770000-0x00007FFA48782000-memory.dmp

Download

memory/4408-2-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/4408-1-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/6120-539-0x00007FFA5FE60000-0x00007FFA5FE62000-memory.dmp

Download

memory/6120-569-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-561-0x000002AB5DB60000-0x000002AB5DBEA000-memory.dmp

Download

memory/6120-562-0x000002AB5DB60000-0x000002AB5DBEA000-memory.dmp

Download

memory/6120-564-0x000002AB5DB60000-0x000002AB5DBEA000-memory.dmp

Download

memory/6120-563-0x000002AB5DB60000-0x000002AB5DBEA000-memory.dmp

Download

memory/6120-558-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-560-0x000002AB5C3C0000-0x000002AB5C40E000-memory.dmp

Download

memory/6120-552-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-550-0x000002AB5A510000-0x000002AB5AA2E000-memory.dmp

Download

memory/6120-547-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-546-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-545-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-544-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-540-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-538-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-532-0x000002AB5A510000-0x000002AB5AA2E000-memory.dmp

Download

memory/6120-677-0x000002AB5CEB0000-0x000002AB5D787000-memory.dmp

Download

memory/6120-531-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download