Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Qte2311.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.954052891374368
Filename:	Qte2311.exe
Filesize:	640000
MD5:	fde8126bd37c19b5f5d3096012ec9300
SHA1:	e469f910764853a6282199890585ff90921b0474
SHA256:	c3a05d6a46d701f52bad7f04085236bd924e33a7590eca472cf2794cce430374
SHA512:	63b3daed244a33ae67646772786ea8eec534af6651590bc20fdd613a4c44e5dec4220a0b83b34886bc5e0aecce5f4b5f96c2dd9c74fcb189fa7f8bca271f81fb
SSDEEP:	12288:IgE2CEFB//SVbAS1i0ZOHPxr6RXSLgCBVF131wQ5wVAvLGUsfLHwRAQR:IgURy0Z1wLVz22iAjG3o
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C.\e..............0......B......6.... ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Software Packing
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
Uses 32bit PE files	Compliance, System Summary	Masquerading
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara signature match	System Summary
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion File and Directory Discovery
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Contains functionality to call native functions	System Summary
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging	Security Software Discovery
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging	Security Software Discovery
Sample file is different than original file name gathered from version info	System Summary
Contains functionality to read the PEB	Anti Debugging
Checks if the current process is being debugged	Anti Debugging
Found large amount of non-executed APIs	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Security Software Discovery Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Uses an in-process (OLE) Automation server	System Summary
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Qte2311.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Qte2311.exe.log
Category:	dropped
Dump:	Qte2311.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Qte2311.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\r27485

Unknown

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\r27485
Category:	dropped
Dump:	r27485.5.dr
ID:	dr_1
Target ID:	5
Process:	C:\Windows\SysWOW64\runas.exe
Type:	Unknown
Entropy:	0.9746603542602881
Encrypted:	false
Ssdeep:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
Size:	114688
Whitelisted:	true
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Qte2311.exe

Details

Is windows:	false
Is dropped:	false
PID:	7420
Target ID:	0
Parent PID:	2580
Name:	Qte2311.exe
Path:	C:\Users\user\Desktop\Qte2311.exe
Commandline:	C:\Users\user\Desktop\Qte2311.exe
Size:	640000
MD5:	FDE8126BD37C19B5F5D3096012EC9300
Time:	04:45:06
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xfb0000
Modulesize:	655360
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\Qte2311.exe

Details

Is windows:	false
Is dropped:	false
PID:	7564
Target ID:	2
Parent PID:	7420
Name:	Qte2311.exe
Path:	C:\Users\user\Desktop\Qte2311.exe
Commandline:	C:\Users\user\Desktop\Qte2311.exe
Size:	640000
MD5:	FDE8126BD37C19B5F5D3096012EC9300
Time:	04:45:08
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x360000
Modulesize:	655360
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\Qte2311.exe

Details

Is windows:	false
Is dropped:	false
PID:	7580
Target ID:	3
Parent PID:	7420
Name:	Qte2311.exe
Path:	C:\Users\user\Desktop\Qte2311.exe
Commandline:	C:\Users\user\Desktop\Qte2311.exe
Size:	640000
MD5:	FDE8126BD37C19B5F5D3096012EC9300
Time:	04:45:08
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xd10000
Modulesize:	655360
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected FormBook	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe

"C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe"

Details

Is windows:	true
Is dropped:	false
PID:	4600
Target ID:	4
Parent PID:	7580
Name:	SoZyKEDyfEWrMWEFcBvwSAkabc.exe
Path:	C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe
Commandline:	"C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe"
Size:	140800
MD5:	32B8AD6ECA9094891E792631BAEA9717
Time:	04:45:09
Date:	21/11/2023
Reason:	existingprocessinject
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x990000
Modulesize:	155648
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\SysWOW64\runas.exe

Details

Is windows:	true
Is dropped:	false
PID:	7624
Target ID:	5
Parent PID:	4600
Name:	runas.exe
Path:	C:\Windows\SysWOW64\runas.exe
Commandline:	C:\Windows\SysWOW64\runas.exe
Size:	17920
MD5:	13646BC81C39130487DA538B2DED5B28
Time:	04:45:10
Date:	21/11/2023
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x460000
Modulesize:	32768
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses runas.exe to run programs with evaluated privileges	HIPS / PFW / Operating System Protection Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe

"C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2312
Target ID:	6
Parent PID:	7624
Name:	SoZyKEDyfEWrMWEFcBvwSAkabc.exe
Path:	C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe
Commandline:	"C:\Program Files (x86)\jFJKUzqwKIBdWDkcySLyDBhTBgNTKdOJMfgYJclsrVfAJDMiwJDDVHpOzszTWBY\SoZyKEDyfEWrMWEFcBvwSAkabc.exe"
Size:	140800
MD5:	32B8AD6ECA9094891E792631BAEA9717
Time:	04:45:22
Date:	21/11/2023
Reason:	existingprocessinject
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x990000
Modulesize:	155648
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queues an APC in another process (thread injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\Firefox.exe

Details

Is windows:	true
Is dropped:	false
PID:	8096
Target ID:	10
Parent PID:	7624
Name:	firefox.exe
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Commandline:	C:\Program Files\Mozilla Firefox\Firefox.exe
Size:	676768
MD5:	C86B1BE9ED6496FE0E0CBE73F81D8045
Time:	04:45:42
Date:	21/11/2023
Reason:	newprocess
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff6bf500000
Modulesize:	708608
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://duckduckgo.com/chrome_newtab

unknown

http://www.fontbureau.com/designersG

unknown

http://www.pjgfupyp.click/do6

unknown

https://duckduckgo.com/ac/?q=

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.drtonks.com/

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.arteunmapa.com/u0t4/

217.160.0.131

http://www.fontbureau.com/designers?

unknown

https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881

unknown

http://www.pjgfupyp.click/2

unknown

http://www.tiro.com

unknown

http://www.beautwin.info/u0t4/?ipNhfX=XNk/b9CReA2PmrT6V9nRJKml7Bwv5n/yLOhYcFkNWR1WhWm4S78oywurhHAd6q+OOWdCw7RAri9AvuhxeeQNKzba3a077jm8zA==&DDMD=2V_pWNT8ifT

66.29.151.121

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://www.fontbureau.com/designers

unknown

http://www.ghswanhar.com/u0t4/

84.32.84.32

http://www.goodfont.co.kr

unknown

http://www.rva.info/u0t4/

13.248.169.48

http://majinfo.tech/u0t4/?ipNhfX=pk6UlYKypwTcdRigHYvXwaXnbRoM4y7Rx6CIM21Q8kT0nxxz4tr7Q0wSojmMfoxURV3

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://www.drtonks.com/u0t4/?ipNhfX=yeZb8GK9kb308m6tqpQSWKVePpKokD/DhHuephdMkCBCe/gXfDvon4YRbmogRZs51d24yXmjv9s2GuQK2J30uG9jNiVx5pUDTA==&DDMD=2V_pWNT8ifT

3.64.163.50

http://www.pjgfupyp.click/

unknown

http://www.ghswanhar.com/u0t4/?ipNhfX=4EteGVMU5QusLCd8WOgjQMJSMXeXzA2vwQTj1x/Wv0fSPBpLzP4ZjqwCxd5WAfB87rYwoEydCHJiwFyGwE65y6hYDNnXCDKbTA==&DDMD=2V_pWNT8ifT

84.32.84.32

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.owcojyyde.best/u0t4/?ipNhfX=T+ktEIOjX9T5dGcj9rUsXIa48WZT28SiLvO+yVBZwvWEp9g0wSKFlyHjxBvBWF4XQFrqNUOHqhRxKaY3zbxWdu06McXUafUYdA==&DDMD=2V_pWNT8ifT

172.67.191.39

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://www.beautwin.info/u0t4/

66.29.151.121

http://www.sakkal.com

unknown

http://www.sakkal.comX

unknown

https://www.rva.info/u0t4/?ipNhfX=0FEhcIE8iszkrFK7conPxoTSm5tbS5zDq5Q/wzqttSHPlx8Adeeig0MIJDbK

unknown

http://www.pjgfupyp.click/u0t4/?ipNhfX=1CC

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.arteunmapa.com/u0t4/?ipNhfX=ZUvXaveAn+Mj+tnST7bSiJ2JwfpFPPY9VKgiVLhz9pIo5hypx732FJmQOFcPVCgcsF350nabn4Y8nAcrKLrIHurvDd/yCXFvmw==&DDMD=2V_pWNT8ifT

217.160.0.131

https://mozilla.org0/

unknown

https://crash-reports.mozilla.com/submit?id=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js

unknown

https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/SplitText.min.js

unknown

http://www.majinfo.tech/u0t4/?ipNhfX=pk6UlYKypwTcdRigHYvXwaXnbRoM4y7Rx6CIM21Q8kT0nxxz4tr7Q0wSojmMfoxURV3iEB8rSWMGZNGZ3jUdb07QIb/TctJEsw==&DDMD=2V_pWNT8ifT

65.21.25.34

http://www.beautwin.info

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://www.rva.info/u0t4/?ipNhfX=0FEhcIE8iszkrFK7conPxoTSm5tbS5zDq5Q/wzqttSHPlx8Adeeig0MIJDbK+dlDXWJ9cmev8ZYmFh9Bk+wzUoT6TgNjxSlOMQ==&DDMD=2V_pWNT8ifT

13.248.169.48

https://cdnjs.cloudflare.com/ajax/libs/gsap/1.20.2/TweenMax.min.js

unknown

https://www.ecosia.org/newtab/

unknown

http://www.carterandcone.coml

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.majinfo.tech/u0t4/

65.21.25.34

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://www.fontbureau.com/designers8

unknown

https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://www.owcojyyde.best/u0t4/

172.67.191.39

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Qte2311.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportQte2311.exe

Files

Processes

URLs

IOC Report
Qte2311.exe