analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

q.exe

Full analysis: https://app.any.run/tasks/ff91c871-fa03-43cb-88cf-cb778a82041a
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 01:26:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

494E7415EE3108CD185770DE97CDA53B

SHA1:

78CC34BBDD1056B115F45DE264F87099D5BEA887

SHA256:

B7380B70D8351E72C70C8FD3874EABCF1BCF25D8562163B5354A8629DBE9CD83

SSDEEP:

192:pBUp6J4dXBMVwnlYJL1LTRSRADm/mEd4e3:pBUpu4dxMzRLTRZDm/mo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • q.exe (PID: 1692)
      • q.exe (PID: 2436)
      • q.exe (PID: 2980)
      • q.exe (PID: 3376)
      • q.exe (PID: 3076)
      • q.exe (PID: 3568)

    • Steals credentials from Web Browsers

      • q.exe (PID: 1692)
      • q.exe (PID: 2436)
      • q.exe (PID: 3376)
      • q.exe (PID: 2980)
      • q.exe (PID: 3568)
      • q.exe (PID: 3076)

    • Actions looks like stealing of personal data

      • q.exe (PID: 1692)
      • q.exe (PID: 2436)
      • q.exe (PID: 2980)
      • q.exe (PID: 3376)
      • q.exe (PID: 3076)
      • q.exe (PID: 3568)

    • Writes to a start menu file

      • q.exe (PID: 2436)

    • Modifies files in Chrome extension folder

      • q.exe (PID: 1692)
      • q.exe (PID: 2980)
      • q.exe (PID: 3568)

    • Stealing of credential data

      • q.exe (PID: 2980)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3144)
      • WINWORD.EXE (PID: 2848)

  • SUSPICIOUS

    • Reads the computer name

      • q.exe (PID: 4060)
      • q.exe (PID: 1692)
      • powershell.exe (PID: 888)
      • q.exe (PID: 2436)
      • q.exe (PID: 2980)
      • q.exe (PID: 3376)
      • q.exe (PID: 3568)
      • q.exe (PID: 3076)

    • Checks supported languages

      • q.exe (PID: 4060)
      • q.exe (PID: 1692)
      • cmd.exe (PID: 3000)
      • cmd.exe (PID: 2828)
      • powershell.exe (PID: 888)
      • q.exe (PID: 2436)
      • q.exe (PID: 2980)
      • q.exe (PID: 3376)
      • DW20.EXE (PID: 3548)
      • DW20.EXE (PID: 3584)
      • q.exe (PID: 3568)
      • q.exe (PID: 3076)

    • Reads the cookies of Google Chrome

      • q.exe (PID: 1692)
      • q.exe (PID: 3568)

    • Drops a file with a compile date too recent

      • q.exe (PID: 1692)
      • q.exe (PID: 2436)
      • q.exe (PID: 2980)
      • q.exe (PID: 3376)
      • q.exe (PID: 3076)
      • q.exe (PID: 3568)

    • Reads the date of Windows installation

      • powershell.exe (PID: 888)

    • Creates files in the user directory

      • powershell.exe (PID: 888)
      • q.exe (PID: 1692)
      • q.exe (PID: 2436)
      • q.exe (PID: 3376)
      • q.exe (PID: 2980)

    • Executes PowerShell scripts

      • powershell.exe (PID: 888)

    • Reads the cookies of Mozilla Firefox

      • q.exe (PID: 2436)

    • Executable content was dropped or overwritten

      • q.exe (PID: 2980)
      • q.exe (PID: 3376)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • q.exe (PID: 3376)
      • q.exe (PID: 2980)

  • INFO

    • Reads the computer name

      • explorer.exe (PID: 3876)
      • WINWORD.EXE (PID: 3144)
      • dwwin.exe (PID: 2728)
      • WINWORD.EXE (PID: 2848)
      • dwwin.exe (PID: 3620)
      • WINWORD.EXE (PID: 3204)

    • Checks supported languages

      • explorer.exe (PID: 3876)
      • where.exe (PID: 3900)
      • where.exe (PID: 2984)
      • where.exe (PID: 3640)
      • where.exe (PID: 540)
      • WINWORD.EXE (PID: 3144)
      • dwwin.exe (PID: 2728)
      • WINWORD.EXE (PID: 2848)
      • dwwin.exe (PID: 3620)
      • WINWORD.EXE (PID: 3204)
      • where.exe (PID: 1992)
      • where.exe (PID: 2464)

    • Manual execution by user

      • explorer.exe (PID: 3876)
      • cmd.exe (PID: 3000)
      • cmd.exe (PID: 2828)
      • powershell.exe (PID: 888)
      • WINWORD.EXE (PID: 3144)
      • WINWORD.EXE (PID: 2848)
      • WINWORD.EXE (PID: 3204)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 888)

    • Reads Microsoft Office registry keys

      • powershell.exe (PID: 888)
      • WINWORD.EXE (PID: 3144)
      • WINWORD.EXE (PID: 2848)
      • WINWORD.EXE (PID: 3204)

    • Dropped object may contain TOR URL's

      • q.exe (PID: 2980)

    • Dropped object may contain Bitcoin addresses

      • q.exe (PID: 2980)
      • q.exe (PID: 3376)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3144)
      • WINWORD.EXE (PID: 2848)
      • WINWORD.EXE (PID: 3204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

AssemblyVersion: 0.0.0.0
ProductVersion: 0.0.0.0
OriginalFileName: q.exe
LegalCopyright:
InternalName: q.exe
FileVersion: 0.0.0.0
FileDescription:
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows command line
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3cee
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 7680
LinkerVersion: 11
PEType: PE32
TimeStamp: 2022:05:21 03:19:19+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 21-May-2022 01:19:19
FileDescription: -
FileVersion: 0.0.0.0
InternalName: q.exe
LegalCopyright: -
OriginalFilename: q.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 21-May-2022 01:19:19
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00001CF4
0x00001E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.39772
.rsrc
0x00004000
0x000004C0
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.66579
.reloc
0x00006000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0815394

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
24
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start q.exe explorer.exe no specs cmd.exe no specs q.exe where.exe no specs cmd.exe no specs powershell.exe no specs q.exe where.exe no specs q.exe where.exe no specs q.exe where.exe no specs winword.exe no specs dw20.exe no specs dwwin.exe no specs winword.exe no specs dw20.exe no specs dwwin.exe no specs winword.exe no specs q.exe where.exe no specs q.exe where.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4060"C:\Users\admin\AppData\Local\Temp\q.exe" C:\Users\admin\AppData\Local\Temp\q.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3762504530
Version:
0.0.0.0
3876"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3000"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1692C:\Users\admin\AppData\Local\Temp\q.exe /eC:\Users\admin\AppData\Local\Temp\q.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3900"where.exe" /r "C:\Users\admin" *C:\Windows\system32\where.exe—q.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Where - Lists location of files
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2828"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
888"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\407d33cc-0893-4f41-b3bf-817ce45a3d68.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
2436C:\Users\admin\AppData\Local\Temp\q.exe /eC:\Users\admin\AppData\Local\Temp\q.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2984"where.exe" /r "C:\Users\admin" *C:\Windows\system32\where.exe—q.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Where - Lists location of files
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2980C:\Users\admin\AppData\Local\Temp\q.exe /dC:\Users\admin\AppData\Local\Temp\q.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Total events
6 321
Read events
5 494
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
4 059
Text files
697
Unknown types
412

Dropped files

PID
Process
Filename
Type
1692q.exeC:\Users\admin\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf.encryptedbinary
MD5:3E46A10F4BB911E5BB76846434939E10
SHA256:BD882AC836A68761AEBFB9FBB32CBBE6145192A7058AA96AF5C7B42706751245
1692q.exeC:\Users\admin\ntuser.dat.LOG1.encryptedbinary
MD5:DD5D9F4FEF971DA46F4E92AB02BC6C58
SHA256:90212043C38F0FD1677BBA6534874239EE86C42651359E2C4E4C7AFBC53403BD
1692q.exeC:\Users\admin\ntuser.dat.LOG2.encryptedbinary
MD5:4DC7ABAD039068290874AB2330C5013C
SHA256:CC043AE53EB62B6EF8263A17BA1A58B7605812D82CD99F455F1907D137738F31
1692q.exeC:\Users\admin\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms.encryptedbinary
MD5:1B1804E30B148A25E9096F5D6FA479AD
SHA256:06EA9A47D1935A29229909F177D61EF2C9CEB3775E3BB90024E198219F4CEA3D
1692q.exeC:\Users\admin\ntuser.ini.encryptedbinary
MD5:014ABE60287CB49DD7001D71475FF167
SHA256:6BFA7E5B639E96B4B7F35376E13CD9DD0FD09525E04A754708DFE9F2DA27937B
1692q.exeC:\Users\admin\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms.encryptedbinary
MD5:CA16E940113358EFBD65F3BA25B360FB
SHA256:0EA56029C5A8AAFB3BBEC66A252DD31716B94C13718BCAF2214A755571C48BD6
1692q.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\gccheck_small.exe.encryptedbinary
MD5:A6791EAC228E314CFA8E9C724E6B1A6D
SHA256:DFB060986F2065B15E8DCE5D6459EEE83E208CBF51295B4811413537C48C815F
1692q.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\gtcheck.exe.encryptedbinary
MD5:586A5FAD2FF0029F803AF7F59670574A
SHA256:48510F156265AA11171B4D96BD7200148C13EACFCFD6C8D465BE369294C79C44
1692q.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\96458326-0F6E-4F95-88EE-ED9F0B2D5401.encryptedbinary
MD5:EAA27D1A291F04289DCBF4BF0C6ED2B3
SHA256:64D0BD593A9DC66EC2F8341BB6E4F5FCA44759230FE6AC00B4EB6DB371903A64
1692q.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\progressbar_blue_active_100.png.encryptedbinary
MD5:10454734AAC4DD426AFDF80DAB7A0175
SHA256:7F36234C78364FE11B1D2F3343FA61647555B89D1510BFFEDC99AD17C98DE46B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
q.exe