Analysis
-
max time kernel
147s -
max time network
15s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
23-09-2020 17:01
Static task
static1
Behavioral task
behavioral1
Sample
999999.exe
Resource
win7v200722
General
-
Target
999999.exe
-
Size
1.2MB
-
MD5
8b3bfff65aa4aa9abbc366ce6d9cc239
-
SHA1
77e69b99e1823a5bc47fa8e395c272a7121f8680
-
SHA256
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
-
SHA512
ad845060c75ceee146cd1d3d4813774acd19a73b7139a297344ecd44116fefa4590109eae3376c1cbab97580b167e08754de91e951f143ac923258c868638464
Malware Config
Extracted
qakbot
abc008
1600855273
77.30.99.99:995
122.165.181.76:995
72.28.255.159:995
108.46.145.30:443
45.77.193.83:443
207.246.75.201:443
108.5.34.248:443
203.198.96.200:443
188.52.107.171:995
184.96.141.112:993
74.129.24.163:443
24.218.181.15:443
197.57.51.59:443
217.162.149.212:443
24.27.82.216:2222
78.97.3.6:443
96.41.93.96:443
197.210.96.222:995
45.32.154.10:443
199.247.16.80:443
76.179.54.116:443
73.228.1.246:443
95.179.247.224:443
96.30.198.161:443
202.141.244.118:995
189.150.106.230:22
39.37.244.25:995
217.165.164.178:2222
51.223.53.162:443
95.77.144.238:443
93.149.253.201:2222
207.237.1.152:443
80.240.26.178:443
77.27.174.49:995
24.205.42.241:443
41.228.240.106:443
89.136.165.31:443
117.218.208.239:443
103.110.49.88:443
83.110.6.64:2222
209.182.122.217:443
75.165.38.209:50002
5.13.179.158:995
72.66.47.70:443
2.88.23.102:995
64.121.114.87:443
5.12.217.37:2222
86.98.89.73:2222
173.245.152.231:443
103.206.112.234:443
98.16.204.189:995
95.77.223.148:443
73.238.141.72:443
102.186.126.62:443
203.106.195.67:443
41.232.234.43:995
36.77.151.211:443
81.133.234.36:2222
151.73.116.80:443
46.53.38.139:443
41.97.86.137:443
45.32.155.12:443
68.46.142.48:995
172.112.163.197:2222
61.3.190.238:443
103.76.160.110:443
175.211.225.118:443
89.42.142.35:443
86.97.11.96:443
72.186.1.237:443
2.50.131.64:443
2.50.59.177:443
73.32.115.251:443
84.117.176.32:443
144.139.47.206:443
65.131.33.110:995
199.247.22.145:443
75.90.6.126:995
93.86.219.77:995
213.31.203.48:2222
2.89.114.174:995
109.154.214.224:2222
80.14.209.42:2222
185.246.9.69:995
94.52.160.116:443
173.21.10.71:2222
71.12.214.209:2222
74.73.27.35:443
95.76.31.12:443
188.26.182.94:443
47.138.201.136:443
81.103.144.77:443
148.75.231.53:443
73.136.242.114:443
108.30.125.94:443
71.217.125.53:2222
95.76.109.181:443
24.128.117.95:443
71.88.104.107:443
71.220.200.82:2222
65.102.149.94:995
75.189.159.193:443
69.123.116.167:2222
116.240.76.97:0
71.197.126.250:443
50.29.166.232:995
93.113.177.152:443
45.46.53.140:2222
96.37.113.36:993
24.28.183.107:995
74.195.88.59:995
189.157.199.133:995
66.76.105.197:443
68.184.45.73:443
68.104.6.221:993
96.237.141.134:995
75.82.182.228:2222
201.103.77.54:443
156.222.102.252:443
1.172.94.252:443
71.218.58.245:443
70.164.37.205:995
71.56.53.127:443
207.255.161.8:993
72.36.59.46:2222
98.240.24.57:443
99.240.226.2:443
69.11.247.242:443
65.30.213.13:6882
71.187.170.235:443
207.255.161.8:2078
207.255.161.8:32100
68.174.15.223:443
50.244.112.10:995
187.206.78.150:995
98.22.65.76:443
68.174.9.179:443
67.209.195.198:443
72.204.242.138:465
59.26.204.144:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
24.231.54.185:2222
50.244.112.106:443
189.231.196.236:443
50.104.68.223:443
75.136.26.147:443
209.137.209.163:995
37.210.186.213:61201
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
olybdgu.exeolybdgu.exepid process 1692 olybdgu.exe 1652 olybdgu.exe -
Loads dropped DLL 1 IoCs
Processes:
999999.exepid process 1288 999999.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
999999.exe999999.exeolybdgu.exeolybdgu.exeexplorer.exepid process 1288 999999.exe 688 999999.exe 688 999999.exe 1692 olybdgu.exe 1652 olybdgu.exe 1652 olybdgu.exe 1920 explorer.exe 1920 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
olybdgu.exepid process 1692 olybdgu.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
999999.exeolybdgu.exetaskeng.exedescription pid process target process PID 1288 wrote to memory of 688 1288 999999.exe 999999.exe PID 1288 wrote to memory of 688 1288 999999.exe 999999.exe PID 1288 wrote to memory of 688 1288 999999.exe 999999.exe PID 1288 wrote to memory of 688 1288 999999.exe 999999.exe PID 1288 wrote to memory of 1692 1288 999999.exe olybdgu.exe PID 1288 wrote to memory of 1692 1288 999999.exe olybdgu.exe PID 1288 wrote to memory of 1692 1288 999999.exe olybdgu.exe PID 1288 wrote to memory of 1692 1288 999999.exe olybdgu.exe PID 1288 wrote to memory of 1812 1288 999999.exe schtasks.exe PID 1288 wrote to memory of 1812 1288 999999.exe schtasks.exe PID 1288 wrote to memory of 1812 1288 999999.exe schtasks.exe PID 1288 wrote to memory of 1812 1288 999999.exe schtasks.exe PID 1692 wrote to memory of 1652 1692 olybdgu.exe olybdgu.exe PID 1692 wrote to memory of 1652 1692 olybdgu.exe olybdgu.exe PID 1692 wrote to memory of 1652 1692 olybdgu.exe olybdgu.exe PID 1692 wrote to memory of 1652 1692 olybdgu.exe olybdgu.exe PID 1692 wrote to memory of 1920 1692 olybdgu.exe explorer.exe PID 1692 wrote to memory of 1920 1692 olybdgu.exe explorer.exe PID 1692 wrote to memory of 1920 1692 olybdgu.exe explorer.exe PID 1692 wrote to memory of 1920 1692 olybdgu.exe explorer.exe PID 1692 wrote to memory of 1920 1692 olybdgu.exe explorer.exe PID 1944 wrote to memory of 832 1944 taskeng.exe 999999.exe PID 1944 wrote to memory of 832 1944 taskeng.exe 999999.exe PID 1944 wrote to memory of 832 1944 taskeng.exe 999999.exe PID 1944 wrote to memory of 832 1944 taskeng.exe 999999.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\999999.exe"C:\Users\Admin\AppData\Local\Temp\999999.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999999.exeC:\Users\Admin\AppData\Local\Temp\999999.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rmxavzjpd /tr "\"C:\Users\Admin\AppData\Local\Temp\999999.exe\" /I rmxavzjpd" /SC ONCE /Z /ST 19:00 /ET 19:122⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {869B0370-7EB8-4F45-A0C4-1BFF5D2F20D1} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999999.exeC:\Users\Admin\AppData\Local\Temp\999999.exe /I rmxavzjpd2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.dat
-
C:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exe
-
\??\PIPE\wkssvc
-
\Users\Admin\AppData\Roaming\Microsoft\Duhohpeui\olybdgu.exe
-
memory/688-1-0x00000000026D0000-0x00000000026E1000-memory.dmpFilesize
68KB
-
memory/688-0-0x0000000000000000-mapping.dmp
-
memory/832-13-0x0000000000000000-mapping.dmp
-
memory/1652-9-0x00000000026B0000-0x00000000026C1000-memory.dmpFilesize
68KB
-
memory/1652-6-0x0000000000000000-mapping.dmp
-
memory/1692-10-0x0000000000350000-0x0000000000387000-memory.dmpFilesize
220KB
-
memory/1692-3-0x0000000000000000-mapping.dmp
-
memory/1812-5-0x0000000000000000-mapping.dmp
-
memory/1920-11-0x0000000000000000-mapping.dmp