Summary

e4a0ce9c71a96748_lqcqisc.exe

File e4a0ce9c71a96748_lqcqisc.exe

Summary
Download Resubmit sample

Size 138.3KB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e7e762022907071f82911fc8a8d571f9
SHA1 200590308d342240a733ef72bf9665c47a99710e
SHA256 e4a0ce9c71a9674868cbe9e61ac135bac6335b162614153a855048e6c6e83313
SHA512
76c1cc129847f503bd57d9d079a7e38ccef1df80db81856adbb53865970dc458c8a6bfe39bde4fc6e1806a87fa85230e075d7f60ff9afeeabe17c753c4a74bf8
CRC32 48487F63
ssdeep None
Yara
  • screenshot - Take screenshot
  • win_registry - Affect system registries

Score

This file is very suspicious, with a score of 9.7 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6684574

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE July 16, 2025, 3:04 p.m. July 16, 2025, 3:09 p.m. 263 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-07-11 08:43:46,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpk4d6bl
2025-07-11 08:43:46,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\uVzQNjIPvJYFaPYw
2025-07-11 08:43:46,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\MqevVMzyfDoUKwwrFTAb
2025-07-11 08:43:46,030 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-11 08:43:46,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-11 08:43:46,342 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-11 08:43:46,342 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-11 08:43:47,062 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-11 08:43:47,265 [analyzer] DEBUG: Loaded monitor into process with pid 512
2025-07-11 08:43:47,265 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-11 08:43:47,265 [analyzer] DEBUG: Started auxiliary module Human
2025-07-11 08:43:47,265 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-11 08:43:47,265 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-11 08:43:47,342 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-11 08:43:47,342 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-11 08:43:47,342 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-11 08:43:47,342 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-11 08:43:47,500 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\e4a0ce9c71a96748_lqcqisc.exe' with arguments '' and pid 2820
2025-07-11 08:43:47,687 [analyzer] DEBUG: Loaded monitor into process with pid 2820
2025-07-11 08:43:52,905 [analyzer] INFO: Added new file to list with pid 2820 and path C:\ProgramData\Mozilla\qaycgck.exe
2025-07-11 08:43:53,500 [analyzer] INFO: Process with pid 2820 has terminated
2025-07-11 08:43:53,500 [analyzer] INFO: Process list is empty, terminating analysis.
2025-07-11 08:43:54,671 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-11 08:43:54,671 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-16 15:04:41,198 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:42,217 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:43,239 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:44,267 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:45,292 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:46,698 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:47,735 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:48,768 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:49,803 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:50,843 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:52,174 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:53,232 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:54,268 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:55,303 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:56,331 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:57,726 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:58,803 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:04:59,835 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:00,872 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:01,907 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:02,945 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:04,182 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:05,239 [cuckoo.core.scheduler] DEBUG: Task #6719491: no machine available yet
2025-07-16 15:05:06,296 [cuckoo.core.scheduler] INFO: Task #6719491: acquired machine win7x6422 (label=win7x6422)
2025-07-16 15:05:06,299 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.222 for task #6719491
2025-07-16 15:05:07,137 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2387078 (interface=vboxnet0, host=192.168.168.222)
2025-07-16 15:05:07,283 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6422
2025-07-16 15:05:08,475 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6422 to vmcloak
2025-07-16 15:07:05,950 [cuckoo.core.guest] INFO: Starting analysis #6719491 on guest (id=win7x6422, ip=192.168.168.222)
2025-07-16 15:07:06,958 [cuckoo.core.guest] DEBUG: win7x6422: not ready yet
2025-07-16 15:07:12,127 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6422, ip=192.168.168.222)
2025-07-16 15:07:12,496 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6422, ip=192.168.168.222, monitor=latest, size=6660546)
2025-07-16 15:07:14,017 [cuckoo.core.resultserver] DEBUG: Task #6719491: live log analysis.log initialized.
2025-07-16 15:07:15,108 [cuckoo.core.resultserver] DEBUG: Task #6719491 is sending a BSON stream
2025-07-16 15:07:15,515 [cuckoo.core.resultserver] DEBUG: Task #6719491 is sending a BSON stream
2025-07-16 15:07:16,538 [cuckoo.core.resultserver] DEBUG: Task #6719491: File upload for 'shots/0001.jpg'
2025-07-16 15:07:16,552 [cuckoo.core.resultserver] DEBUG: Task #6719491 uploaded file length: 133450
2025-07-16 15:07:22,470 [cuckoo.core.resultserver] DEBUG: Task #6719491: File upload for 'curtain/1752216234.56.curtain.log'
2025-07-16 15:07:22,473 [cuckoo.core.resultserver] DEBUG: Task #6719491 uploaded file length: 36
2025-07-16 15:07:22,581 [cuckoo.core.resultserver] DEBUG: Task #6719491: File upload for 'sysmon/1752216234.66.sysmon.xml'
2025-07-16 15:07:22,593 [cuckoo.core.resultserver] DEBUG: Task #6719491: File upload for 'files/eab752525c0f6538_qaycgck.exe'
2025-07-16 15:07:22,597 [cuckoo.core.resultserver] DEBUG: Task #6719491 uploaded file length: 141608
2025-07-16 15:07:22,602 [cuckoo.core.resultserver] DEBUG: Task #6719491 uploaded file length: 482510
2025-07-16 15:07:22,660 [cuckoo.core.resultserver] DEBUG: Task #6719491 had connection reset for <Context for LOG>
2025-07-16 15:07:25,783 [cuckoo.core.guest] INFO: win7x6422: analysis completed successfully
2025-07-16 15:07:25,802 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-16 15:07:25,826 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-16 15:07:27,116 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6422 to path /srv/cuckoo/cwd/storage/analyses/6719491/memory.dmp
2025-07-16 15:07:27,117 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6422
2025-07-16 15:09:03,718 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.222 for task #6719491
2025-07-16 15:09:04,260 [cuckoo.core.scheduler] DEBUG: Released database task #6719491
2025-07-16 15:09:04,278 [cuckoo.core.scheduler] INFO: Task #6719491: analysis procedure completed

Signatures

Yara rules detected for file (2 events)
description Take screenshot rule screenshot
description Affect system registries rule win_registry
Allocates read-write-execute memory (usually to unpack itself) (2 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00402000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00880000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Queries for the computername (1 event)
Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: RTDRUOBVHNBTXI
1 1 0
Checks if process is being debugged by a debugger (1 event)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .htext
Creates executable files on the filesystem (1 event)
file C:\ProgramData\Mozilla\qaycgck.exe
File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Lazy.532293 (Engine A)
Avast Core Security (Linux) Win32:Kryptik-LZD [Trj]
C4S ClamAV (Linux) Win.Malware.Bladabindi-10019611-0
WithSecure (Linux) Trojan.TR/Crypt.ZPACK.Gen7
eScan Antivirus (Linux) Gen:Variant.Lazy.532293(DB)
ESET Security (Windows) a variant of Win32/Kryptik.BCUX trojan
DrWeb Antivirus (Linux) Trojan.Mods.146
ClamAV (Linux) Win.Malware.Bladabindi-10019611-0
Bitdefender Antivirus (Linux) Gen:Variant.Lazy.532293
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows) Gen:Variant.Lazy.532293 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.