Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-11-2020 08:19
Static task
static1
General
-
Target
ufctqm.exe
-
Size
288KB
-
MD5
6a4ac643acc40f5c9bf45f6b66c98747
-
SHA1
196715f3b45aab4894651b0cdb9bd811f203cc7b
-
SHA256
a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
-
SHA512
6a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
Malware Config
Extracted
qakbot
notset
1596817234
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
logger@dustinkeeling.com - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
logger@misterexterior.com - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
cpanel@vivekharris-architects.com - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
cpanel@dovetailsolar.com - Password:
eQyicNLzzqPN
47.44.217.98:443
86.97.146.204:2222
65.60.228.130:443
216.201.162.158:443
94.59.24.79:995
108.46.145.30:443
24.139.132.70:443
47.206.174.82:443
188.52.106.206:20
72.204.242.138:6881
173.173.72.199:443
71.163.224.206:443
63.155.9.141:995
100.34.195.237:443
47.39.177.171:2222
96.20.108.17:2222
115.21.224.117:443
70.164.39.91:443
45.47.65.191:443
207.155.107.111:443
75.82.182.228:2222
108.30.125.94:443
73.227.232.166:443
207.255.161.8:993
24.122.228.88:443
64.130.165.255:443
200.38.254.177:443
100.4.173.223:443
172.242.80.243:443
71.74.12.34:443
174.80.7.235:443
151.205.102.42:443
84.247.55.190:443
201.248.122.51:2078
72.190.101.70:443
108.183.3.41:443
151.213.81.220:995
5.193.178.241:2078
179.14.167.91:443
24.71.28.247:443
100.43.250.74:995
73.60.148.209:443
24.234.86.201:995
95.77.144.238:443
156.213.224.213:993
51.241.113.55:443
86.182.234.245:2222
71.220.191.200:443
199.247.22.145:443
173.245.152.231:443
151.76.217.248:443
191.84.3.226:443
31.5.21.66:443
68.4.137.211:443
141.158.47.123:443
130.25.130.19:2222
5.12.50.188:443
72.142.106.198:465
96.234.20.230:443
166.62.180.194:2078
75.136.40.155:443
98.243.187.85:443
65.96.36.157:443
67.11.43.93:443
81.133.234.36:2222
41.227.89.38:443
201.127.3.56:443
174.82.131.155:995
189.130.26.216:443
75.182.214.87:443
47.146.32.175:443
84.117.176.32:443
188.15.173.34:995
12.5.37.3:995
74.75.237.11:443
200.124.231.21:443
5.15.84.129:443
121.164.25.197:443
96.35.170.82:2078
165.228.200.94:443
103.238.231.40:443
189.223.67.205:443
151.73.114.37:443
71.197.126.250:443
187.200.109.243:443
65.48.219.199:53
24.99.180.247:443
173.163.115.89:2078
71.192.44.92:443
84.117.60.157:443
68.116.193.239:443
71.182.142.63:443
188.52.106.206:443
37.210.160.50:61201
67.6.62.74:443
100.38.164.182:443
193.248.44.2:2222
74.222.204.82:443
209.182.122.217:443
156.222.64.172:995
24.44.142.213:2222
71.83.16.211:443
69.123.179.70:443
70.126.76.75:443
188.173.70.18:443
69.47.239.10:443
201.216.216.245:443
98.219.77.197:443
75.110.250.89:995
97.124.162.104:995
2.88.50.153:995
70.164.37.205:995
217.165.110.181:443
104.235.63.89:443
2.90.70.49:995
66.30.92.147:443
98.26.50.62:995
217.165.112.13:995
46.248.41.66:995
94.59.241.189:995
98.4.227.199:443
76.111.128.194:443
189.163.82.104:443
72.82.15.220:443
67.209.195.198:443
149.71.51.2:443
99.195.112.165:443
73.228.1.246:443
77.27.173.8:995
68.39.160.40:443
108.45.89.47:443
68.59.27.48:443
95.76.109.181:443
80.240.26.178:443
72.214.55.195:995
199.247.16.80:443
74.109.219.145:443
108.51.130.83:443
76.187.12.181:443
187.192.233.135:995
99.231.221.117:443
72.240.200.181:2222
172.87.134.226:443
84.232.238.30:443
68.190.152.98:443
67.165.206.193:993
75.183.171.155:995
67.8.103.21:443
70.123.92.175:2222
92.59.35.196:2222
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cqxigki.execqxigki.exepid process 1640 cqxigki.exe 2000 cqxigki.exe -
Loads dropped DLL 2 IoCs
Processes:
ufctqm.exepid process 2028 ufctqm.exe 2028 ufctqm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
ufctqm.exeufctqm.execqxigki.execqxigki.exeexplorer.exeufctqm.exepid process 2028 ufctqm.exe 792 ufctqm.exe 792 ufctqm.exe 1640 cqxigki.exe 2000 cqxigki.exe 2000 cqxigki.exe 436 explorer.exe 436 explorer.exe 1120 ufctqm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cqxigki.exepid process 1640 cqxigki.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
ufctqm.execqxigki.exetaskeng.exedescription pid process target process PID 2028 wrote to memory of 792 2028 ufctqm.exe ufctqm.exe PID 2028 wrote to memory of 792 2028 ufctqm.exe ufctqm.exe PID 2028 wrote to memory of 792 2028 ufctqm.exe ufctqm.exe PID 2028 wrote to memory of 792 2028 ufctqm.exe ufctqm.exe PID 2028 wrote to memory of 1640 2028 ufctqm.exe cqxigki.exe PID 2028 wrote to memory of 1640 2028 ufctqm.exe cqxigki.exe PID 2028 wrote to memory of 1640 2028 ufctqm.exe cqxigki.exe PID 2028 wrote to memory of 1640 2028 ufctqm.exe cqxigki.exe PID 2028 wrote to memory of 1664 2028 ufctqm.exe schtasks.exe PID 2028 wrote to memory of 1664 2028 ufctqm.exe schtasks.exe PID 2028 wrote to memory of 1664 2028 ufctqm.exe schtasks.exe PID 2028 wrote to memory of 1664 2028 ufctqm.exe schtasks.exe PID 1640 wrote to memory of 2000 1640 cqxigki.exe cqxigki.exe PID 1640 wrote to memory of 2000 1640 cqxigki.exe cqxigki.exe PID 1640 wrote to memory of 2000 1640 cqxigki.exe cqxigki.exe PID 1640 wrote to memory of 2000 1640 cqxigki.exe cqxigki.exe PID 1640 wrote to memory of 436 1640 cqxigki.exe explorer.exe PID 1640 wrote to memory of 436 1640 cqxigki.exe explorer.exe PID 1640 wrote to memory of 436 1640 cqxigki.exe explorer.exe PID 1640 wrote to memory of 436 1640 cqxigki.exe explorer.exe PID 1640 wrote to memory of 436 1640 cqxigki.exe explorer.exe PID 1192 wrote to memory of 1120 1192 taskeng.exe ufctqm.exe PID 1192 wrote to memory of 1120 1192 taskeng.exe ufctqm.exe PID 1192 wrote to memory of 1120 1192 taskeng.exe ufctqm.exe PID 1192 wrote to memory of 1120 1192 taskeng.exe ufctqm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ufctqm.exe"C:\Users\Admin\AppData\Local\Temp\ufctqm.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ufctqm.exeC:\Users\Admin\AppData\Local\Temp\ufctqm.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ogdigeuas /tr "\"C:\Users\Admin\AppData\Local\Temp\ufctqm.exe\" /I ogdigeuas" /SC ONCE /Z /ST 08:25 /ET 08:372⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {D8453CC5-715A-44A4-8F32-474258DA9F3C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ufctqm.exeC:\Users\Admin\AppData\Local\Temp\ufctqm.exe /I ogdigeuas2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.datMD5
2cff3d0f4560a6e9769baef5cbea7e8d
SHA1ab8892b1a3243b827b1183911d5b7cc62c177704
SHA256766a84dacbdc9e6d3825785f5d4dcc0c605c43eb0792e2df5813409ab34ae526
SHA512a587a015148f8c5fa2c2d6bcc57c541205715210c146b46af972b4c159fefc3214636a184fb7915894f60ea9f8e3d1f58dde520ec65cd15d11294b682e634a97
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeMD5
6a4ac643acc40f5c9bf45f6b66c98747
SHA1196715f3b45aab4894651b0cdb9bd811f203cc7b
SHA256a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
SHA5126a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeMD5
6a4ac643acc40f5c9bf45f6b66c98747
SHA1196715f3b45aab4894651b0cdb9bd811f203cc7b
SHA256a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
SHA5126a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeMD5
6a4ac643acc40f5c9bf45f6b66c98747
SHA1196715f3b45aab4894651b0cdb9bd811f203cc7b
SHA256a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
SHA5126a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeMD5
6a4ac643acc40f5c9bf45f6b66c98747
SHA1196715f3b45aab4894651b0cdb9bd811f203cc7b
SHA256a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
SHA5126a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
-
\Users\Admin\AppData\Roaming\Microsoft\Uptruhaver\cqxigki.exeMD5
6a4ac643acc40f5c9bf45f6b66c98747
SHA1196715f3b45aab4894651b0cdb9bd811f203cc7b
SHA256a7d481c0f6ec7902ac7af13a9195ba6743c8baea25fabe3c206b743eb4dd39ab
SHA5126a662d702a44ab26500b3d0ca1fe38d3ca1d4819b047e74363d54109537a77a002cd694b5172fae20f33a60fc2d6a06082f6e568e279d310056bebbf1838df7e
-
memory/436-13-0x0000000000000000-mapping.dmp
-
memory/792-0-0x0000000000000000-mapping.dmp
-
memory/792-1-0x0000000002580000-0x0000000002591000-memory.dmpFilesize
68KB
-
memory/1120-15-0x0000000000000000-mapping.dmp
-
memory/1640-12-0x0000000000750000-0x0000000000797000-memory.dmpFilesize
284KB
-
memory/1640-4-0x0000000000000000-mapping.dmp
-
memory/1664-6-0x0000000000000000-mapping.dmp
-
memory/2000-11-0x0000000002490000-0x00000000024A1000-memory.dmpFilesize
68KB
-
memory/2000-8-0x0000000000000000-mapping.dmp