Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10_x64 -
resource
win10 -
submitted
23-09-2020 17:01
Static task
static1
Behavioral task
behavioral1
Sample
999999.exe
Resource
win7v200722
General
-
Target
999999.exe
-
Size
1.2MB
-
MD5
8b3bfff65aa4aa9abbc366ce6d9cc239
-
SHA1
77e69b99e1823a5bc47fa8e395c272a7121f8680
-
SHA256
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
-
SHA512
ad845060c75ceee146cd1d3d4813774acd19a73b7139a297344ecd44116fefa4590109eae3376c1cbab97580b167e08754de91e951f143ac923258c868638464
Malware Config
Extracted
qakbot
abc008
1600855273
77.30.99.99:995
122.165.181.76:995
72.28.255.159:995
108.46.145.30:443
45.77.193.83:443
207.246.75.201:443
108.5.34.248:443
203.198.96.200:443
188.52.107.171:995
184.96.141.112:993
74.129.24.163:443
24.218.181.15:443
197.57.51.59:443
217.162.149.212:443
24.27.82.216:2222
78.97.3.6:443
96.41.93.96:443
197.210.96.222:995
45.32.154.10:443
199.247.16.80:443
76.179.54.116:443
73.228.1.246:443
95.179.247.224:443
96.30.198.161:443
202.141.244.118:995
189.150.106.230:22
39.37.244.25:995
217.165.164.178:2222
51.223.53.162:443
95.77.144.238:443
93.149.253.201:2222
207.237.1.152:443
80.240.26.178:443
77.27.174.49:995
24.205.42.241:443
41.228.240.106:443
89.136.165.31:443
117.218.208.239:443
103.110.49.88:443
83.110.6.64:2222
209.182.122.217:443
75.165.38.209:50002
5.13.179.158:995
72.66.47.70:443
2.88.23.102:995
64.121.114.87:443
5.12.217.37:2222
86.98.89.73:2222
173.245.152.231:443
103.206.112.234:443
98.16.204.189:995
95.77.223.148:443
73.238.141.72:443
102.186.126.62:443
203.106.195.67:443
41.232.234.43:995
36.77.151.211:443
81.133.234.36:2222
151.73.116.80:443
46.53.38.139:443
41.97.86.137:443
45.32.155.12:443
68.46.142.48:995
172.112.163.197:2222
61.3.190.238:443
103.76.160.110:443
175.211.225.118:443
89.42.142.35:443
86.97.11.96:443
72.186.1.237:443
2.50.131.64:443
2.50.59.177:443
73.32.115.251:443
84.117.176.32:443
144.139.47.206:443
65.131.33.110:995
199.247.22.145:443
75.90.6.126:995
93.86.219.77:995
213.31.203.48:2222
2.89.114.174:995
109.154.214.224:2222
80.14.209.42:2222
185.246.9.69:995
94.52.160.116:443
173.21.10.71:2222
71.12.214.209:2222
74.73.27.35:443
95.76.31.12:443
188.26.182.94:443
47.138.201.136:443
81.103.144.77:443
148.75.231.53:443
73.136.242.114:443
108.30.125.94:443
71.217.125.53:2222
95.76.109.181:443
24.128.117.95:443
71.88.104.107:443
71.220.200.82:2222
65.102.149.94:995
75.189.159.193:443
69.123.116.167:2222
116.240.76.97:0
71.197.126.250:443
50.29.166.232:995
93.113.177.152:443
45.46.53.140:2222
96.37.113.36:993
24.28.183.107:995
74.195.88.59:995
189.157.199.133:995
66.76.105.197:443
68.184.45.73:443
68.104.6.221:993
96.237.141.134:995
75.82.182.228:2222
201.103.77.54:443
156.222.102.252:443
1.172.94.252:443
71.218.58.245:443
70.164.37.205:995
71.56.53.127:443
207.255.161.8:993
72.36.59.46:2222
98.240.24.57:443
99.240.226.2:443
69.11.247.242:443
65.30.213.13:6882
71.187.170.235:443
207.255.161.8:2078
207.255.161.8:32100
68.174.15.223:443
50.244.112.10:995
187.206.78.150:995
98.22.65.76:443
68.174.9.179:443
67.209.195.198:443
72.204.242.138:465
59.26.204.144:443
75.81.25.223:443
50.232.172.114:443
184.180.157.203:2222
24.231.54.185:2222
50.244.112.106:443
189.231.196.236:443
50.104.68.223:443
75.136.26.147:443
209.137.209.163:995
37.210.186.213:61201
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
iimgx.exeiimgx.exepid process 1500 iimgx.exe 1544 iimgx.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
iimgx.exe999999.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc iimgx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 999999.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 999999.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 999999.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 999999.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 iimgx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc iimgx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 iimgx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service iimgx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 999999.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 999999.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service iimgx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
999999.exe999999.exeiimgx.exeiimgx.exeexplorer.exe999999.exepid process 3676 999999.exe 3676 999999.exe 1216 999999.exe 1216 999999.exe 1216 999999.exe 1216 999999.exe 1500 iimgx.exe 1500 iimgx.exe 1544 iimgx.exe 1544 iimgx.exe 1544 iimgx.exe 1544 iimgx.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2496 999999.exe 2496 999999.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
iimgx.exepid process 1500 iimgx.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
999999.exeiimgx.exedescription pid process target process PID 3676 wrote to memory of 1216 3676 999999.exe 999999.exe PID 3676 wrote to memory of 1216 3676 999999.exe 999999.exe PID 3676 wrote to memory of 1216 3676 999999.exe 999999.exe PID 3676 wrote to memory of 1500 3676 999999.exe iimgx.exe PID 3676 wrote to memory of 1500 3676 999999.exe iimgx.exe PID 3676 wrote to memory of 1500 3676 999999.exe iimgx.exe PID 3676 wrote to memory of 1648 3676 999999.exe schtasks.exe PID 3676 wrote to memory of 1648 3676 999999.exe schtasks.exe PID 3676 wrote to memory of 1648 3676 999999.exe schtasks.exe PID 1500 wrote to memory of 1544 1500 iimgx.exe iimgx.exe PID 1500 wrote to memory of 1544 1500 iimgx.exe iimgx.exe PID 1500 wrote to memory of 1544 1500 iimgx.exe iimgx.exe PID 1500 wrote to memory of 2140 1500 iimgx.exe explorer.exe PID 1500 wrote to memory of 2140 1500 iimgx.exe explorer.exe PID 1500 wrote to memory of 2140 1500 iimgx.exe explorer.exe PID 1500 wrote to memory of 2140 1500 iimgx.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\999999.exe"C:\Users\Admin\AppData\Local\Temp\999999.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999999.exeC:\Users\Admin\AppData\Local\Temp\999999.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gutspct /tr "\"C:\Users\Admin\AppData\Local\Temp\999999.exe\" /I gutspct" /SC ONCE /Z /ST 17:07 /ET 17:192⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\999999.exeC:\Users\Admin\AppData\Local\Temp\999999.exe /I gutspct1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.dat
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Teeut\iimgx.exe
-
\??\PIPE\wkssvc
-
memory/1216-1-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/1216-0-0x0000000000000000-mapping.dmp
-
memory/1500-9-0x00000000006C0000-0x00000000006F7000-memory.dmpFilesize
220KB
-
memory/1500-2-0x0000000000000000-mapping.dmp
-
memory/1544-8-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/1544-6-0x0000000000000000-mapping.dmp
-
memory/1648-5-0x0000000000000000-mapping.dmp
-
memory/2140-10-0x0000000000000000-mapping.dmp