Analysis
-
max time kernel
132s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 14:40
Static task
static1
General
-
Target
kgwlrl.exe
-
Size
1.9MB
-
MD5
59ac77320f3c775bdeab0d7693a4f633
-
SHA1
fabc8ca07d4b8f5ea8b2a01f2d6ae0d66d133302
-
SHA256
357225bfe5e097f7dbbbe58e76eb396aed159ee54494bcd24bc01a52c36b832d
-
SHA512
d379d0d86391e31d5a5023e813e2fcf4655e16ce628a5f2693951311de82689471a2731a1e67aec0a18b2d18e1943e9bba644b534f17b5ff6a1a405854f1adbb
Malware Config
Extracted
qakbot
notset
1604404534
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
logger@dustinkeeling.com - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
logger@misterexterior.com - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
cpanel@vivekharris-architects.com - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
cpanel@dovetailsolar.com - Password:
eQyicNLzzqPN
67.6.55.77:443
89.136.39.108:443
2.50.58.76:443
188.25.158.61:443
45.63.107.192:995
45.32.154.10:443
94.52.160.116:443
45.63.107.192:2222
45.63.107.192:443
72.204.242.138:465
84.117.176.32:443
95.77.223.148:443
47.146.39.147:443
41.225.13.128:8443
80.14.209.42:2222
190.220.8.10:995
66.76.105.194:443
105.101.69.242:443
89.33.87.107:443
75.136.40.155:443
78.97.3.6:443
108.46.145.30:443
68.134.181.98:443
85.121.42.12:995
75.87.161.32:995
68.174.15.223:443
149.28.99.97:995
199.247.16.80:443
45.32.155.12:443
149.28.99.97:2222
149.28.99.97:443
70.168.130.172:995
93.86.252.177:995
50.244.112.10:995
59.99.36.238:443
185.246.9.69:995
208.99.100.129:443
41.97.25.63:443
72.186.1.237:443
59.99.36.241:443
45.32.155.12:2222
96.30.198.161:443
140.82.27.132:443
45.32.165.134:443
45.63.104.123:443
207.246.70.216:443
97.118.38.31:993
134.228.24.29:443
188.25.24.21:2222
2.89.17.127:995
72.82.15.220:443
174.62.13.151:443
120.150.60.189:995
80.195.103.146:2222
142.129.227.86:443
89.137.221.232:443
98.26.50.62:995
74.129.26.119:443
146.199.132.233:2222
77.27.174.49:995
172.114.116.226:995
95.179.247.224:443
189.231.189.64:443
45.32.155.12:995
45.32.162.253:443
199.247.22.145:443
35.134.202.234:443
184.98.97.227:995
85.122.141.42:995
89.137.211.239:443
72.16.56.171:443
72.28.255.159:995
47.44.217.98:443
189.183.206.170:995
64.185.5.157:443
202.141.244.118:995
72.209.191.27:443
86.122.18.250:443
141.158.47.123:443
203.198.96.164:443
173.245.152.231:443
95.77.144.238:443
41.228.227.124:443
67.78.151.218:2222
84.232.238.30:443
188.27.32.167:443
173.3.17.223:995
201.215.96.174:0
69.11.247.242:443
87.65.204.240:995
207.246.75.201:443
217.162.149.212:443
45.77.193.83:443
80.240.26.178:443
98.16.204.189:995
173.90.33.182:2222
103.206.112.234:443
72.36.59.46:2222
190.220.8.10:443
86.98.89.245:2222
39.36.35.237:995
217.165.96.127:990
151.73.112.197:443
79.113.119.125:443
2.50.110.49:2078
72.66.47.70:443
93.113.177.152:443
103.238.231.35:443
78.97.207.104:443
156.213.227.208:443
71.163.223.253:443
108.31.15.10:995
184.21.136.237:443
184.179.14.130:22
81.133.234.36:2222
74.75.216.202:443
2.51.247.69:995
96.243.35.201:443
46.53.16.93:443
217.165.2.92:995
37.106.7.143:443
203.106.195.67:443
172.91.19.192:443
2.7.202.106:2222
78.96.199.79:443
184.55.32.182:443
24.205.42.241:443
103.76.160.110:443
188.121.219.88:2222
79.113.208.68:443
85.204.189.105:443
50.96.234.132:995
31.5.21.66:443
66.215.32.224:443
81.97.154.100:443
47.185.140.236:80
108.30.125.94:443
188.247.252.243:443
69.47.26.41:443
74.195.88.59:443
95.76.27.6:443
68.46.142.48:995
73.200.219.143:443
173.173.1.164:443
24.40.173.134:443
173.21.10.71:2222
73.225.67.0:443
45.47.65.191:443
75.106.52.142:443
75.182.220.196:2222
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wmqqolih.exewmqqolih.exepid process 968 wmqqolih.exe 488 wmqqolih.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wmqqolih.exekgwlrl.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service wmqqolih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 wmqqolih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 kgwlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 kgwlrl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc kgwlrl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service kgwlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 wmqqolih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc wmqqolih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc kgwlrl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service kgwlrl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc wmqqolih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service wmqqolih.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
kgwlrl.exekgwlrl.exewmqqolih.exewmqqolih.exeexplorer.exekgwlrl.exepid process 428 kgwlrl.exe 428 kgwlrl.exe 804 kgwlrl.exe 804 kgwlrl.exe 804 kgwlrl.exe 804 kgwlrl.exe 968 wmqqolih.exe 968 wmqqolih.exe 488 wmqqolih.exe 488 wmqqolih.exe 488 wmqqolih.exe 488 wmqqolih.exe 3624 explorer.exe 3624 explorer.exe 3624 explorer.exe 3624 explorer.exe 3520 kgwlrl.exe 3520 kgwlrl.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
wmqqolih.exepid process 968 wmqqolih.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
kgwlrl.exewmqqolih.exedescription pid process target process PID 428 wrote to memory of 804 428 kgwlrl.exe kgwlrl.exe PID 428 wrote to memory of 804 428 kgwlrl.exe kgwlrl.exe PID 428 wrote to memory of 804 428 kgwlrl.exe kgwlrl.exe PID 428 wrote to memory of 968 428 kgwlrl.exe wmqqolih.exe PID 428 wrote to memory of 968 428 kgwlrl.exe wmqqolih.exe PID 428 wrote to memory of 968 428 kgwlrl.exe wmqqolih.exe PID 428 wrote to memory of 1520 428 kgwlrl.exe schtasks.exe PID 428 wrote to memory of 1520 428 kgwlrl.exe schtasks.exe PID 428 wrote to memory of 1520 428 kgwlrl.exe schtasks.exe PID 968 wrote to memory of 488 968 wmqqolih.exe wmqqolih.exe PID 968 wrote to memory of 488 968 wmqqolih.exe wmqqolih.exe PID 968 wrote to memory of 488 968 wmqqolih.exe wmqqolih.exe PID 968 wrote to memory of 3624 968 wmqqolih.exe explorer.exe PID 968 wrote to memory of 3624 968 wmqqolih.exe explorer.exe PID 968 wrote to memory of 3624 968 wmqqolih.exe explorer.exe PID 968 wrote to memory of 3624 968 wmqqolih.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kgwlrl.exe"C:\Users\Admin\AppData\Local\Temp\kgwlrl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kgwlrl.exeC:\Users\Admin\AppData\Local\Temp\kgwlrl.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exeC:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exeC:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ptrrrbb /tr "\"C:\Users\Admin\AppData\Local\Temp\kgwlrl.exe\" /I ptrrrbb" /SC ONCE /Z /ST 15:39 /ET 15:512⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\kgwlrl.exeC:\Users\Admin\AppData\Local\Temp\kgwlrl.exe /I ptrrrbb1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.datMD5
904b1d4786bb6fae47905c696fd19688
SHA14873d71426d3d3a713c4d3e8d16766a84a74e1f6
SHA256e61d13cdb351367a4c1ed7148449f297d7ee0da9869035f6b8d09af1b896a8ba
SHA5126fbc1ed1351435c876ff8c4b8656b8140f27e7f34628cff21d9243ae6a5d2df971e1a58e14700435fa14af5dcceb51fe4942aa3d6d7d50d3bc87bd59dcee47a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exeMD5
59ac77320f3c775bdeab0d7693a4f633
SHA1fabc8ca07d4b8f5ea8b2a01f2d6ae0d66d133302
SHA256357225bfe5e097f7dbbbe58e76eb396aed159ee54494bcd24bc01a52c36b832d
SHA512d379d0d86391e31d5a5023e813e2fcf4655e16ce628a5f2693951311de82689471a2731a1e67aec0a18b2d18e1943e9bba644b534f17b5ff6a1a405854f1adbb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exeMD5
59ac77320f3c775bdeab0d7693a4f633
SHA1fabc8ca07d4b8f5ea8b2a01f2d6ae0d66d133302
SHA256357225bfe5e097f7dbbbe58e76eb396aed159ee54494bcd24bc01a52c36b832d
SHA512d379d0d86391e31d5a5023e813e2fcf4655e16ce628a5f2693951311de82689471a2731a1e67aec0a18b2d18e1943e9bba644b534f17b5ff6a1a405854f1adbb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sekyrrrowooi\wmqqolih.exeMD5
59ac77320f3c775bdeab0d7693a4f633
SHA1fabc8ca07d4b8f5ea8b2a01f2d6ae0d66d133302
SHA256357225bfe5e097f7dbbbe58e76eb396aed159ee54494bcd24bc01a52c36b832d
SHA512d379d0d86391e31d5a5023e813e2fcf4655e16ce628a5f2693951311de82689471a2731a1e67aec0a18b2d18e1943e9bba644b534f17b5ff6a1a405854f1adbb
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/488-6-0x0000000000000000-mapping.dmp
-
memory/488-8-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/804-1-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/804-0-0x0000000000000000-mapping.dmp
-
memory/968-2-0x0000000000000000-mapping.dmp
-
memory/968-9-0x00000000021C0000-0x00000000021FA000-memory.dmpFilesize
232KB
-
memory/1520-5-0x0000000000000000-mapping.dmp
-
memory/3624-10-0x0000000000000000-mapping.dmp