Analysis
-
max time kernel
95s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
07-05-2021 05:02
Static task
static1
Behavioral task
behavioral1
Sample
19.gif.exe
Resource
win7v20210408
General
-
Target
19.gif.exe
-
Size
269KB
-
MD5
336aaae4fa380c66834c8665172cf179
-
SHA1
c0a93f789ce3bb1471cce677573f05143192cc90
-
SHA256
7803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
-
SHA512
1f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
Malware Config
Extracted
qakbot
325.43
tr01
1602688146
73.228.1.246:443
74.109.219.145:443
76.111.128.194:443
90.175.88.99:2222
108.191.28.158:443
68.225.60.77:443
75.136.40.155:443
5.193.181.221:2078
72.204.242.138:20
118.160.162.234:443
68.14.210.246:22
148.101.74.12:443
74.222.204.82:443
96.30.198.161:443
140.82.27.132:443
2.50.131.64:443
45.32.155.12:995
45.63.104.123:443
45.32.165.134:443
217.162.149.212:443
207.246.70.216:443
200.75.136.78:443
187.155.58.60:443
166.62.183.139:2078
35.134.202.234:443
67.170.137.8:443
70.45.126.135:443
173.21.10.71:2222
96.247.181.229:443
76.167.240.21:443
67.165.206.193:993
71.80.66.107:443
81.98.133.106:443
190.63.182.214:443
71.197.126.250:443
71.220.191.200:443
24.71.28.247:443
71.56.53.127:443
24.43.22.220:993
81.133.234.36:2222
69.47.239.10:443
80.195.103.146:2222
78.96.199.79:443
65.131.47.228:995
86.121.121.14:2222
96.243.35.201:443
173.70.165.101:995
80.14.209.42:2222
2.51.221.138:995
76.170.77.99:995
46.53.38.174:443
68.116.193.239:443
187.213.152.50:995
50.244.112.10:995
2.88.42.65:995
69.47.26.41:443
151.73.121.31:443
108.46.145.30:443
71.187.170.235:443
75.136.26.147:443
134.0.196.46:995
98.118.156.172:443
199.116.241.147:443
75.137.239.211:443
103.238.231.35:443
74.75.216.202:443
184.21.136.237:443
71.182.142.63:443
78.97.3.6:443
108.190.151.108:2222
85.121.42.12:995
67.6.55.77:443
141.158.47.123:443
98.240.24.57:443
68.46.142.48:995
151.205.102.42:443
172.87.134.226:443
187.213.186.154:443
72.204.242.138:443
72.240.200.181:2222
72.36.59.46:2222
24.229.150.54:995
100.4.179.64:443
190.85.91.154:443
31.215.98.218:443
47.28.131.209:443
207.255.161.8:993
207.246.75.201:443
77.159.149.74:443
45.77.193.83:443
71.19.217.23:443
86.121.215.99:443
207.255.161.8:995
184.180.157.203:2222
108.35.13.206:443
24.122.0.90:443
67.209.195.198:443
68.190.152.98:443
72.204.242.138:465
65.30.213.13:6882
188.27.178.166:443
207.255.161.8:32103
186.154.182.103:443
72.190.101.70:443
208.99.100.129:443
63.155.8.102:995
178.222.13.77:995
70.123.92.175:2222
108.5.33.110:443
70.168.130.172:995
45.32.154.10:443
199.247.22.145:443
80.240.26.178:443
85.204.189.105:443
102.190.183.108:443
207.255.161.8:443
66.215.32.224:443
71.28.7.23:443
86.176.25.92:2222
61.230.0.156:443
207.255.161.8:32100
41.228.59.195:443
67.60.113.253:2222
117.218.208.239:443
206.183.190.53:993
184.98.103.204:995
134.228.24.29:443
66.97.247.15:443
72.204.242.138:50001
72.204.242.138:32100
66.26.160.37:443
86.98.89.172:2222
72.82.15.220:443
24.37.178.158:443
47.44.217.98:443
72.204.242.138:995
95.179.247.224:443
172.78.30.215:443
39.36.156.196:995
24.234.86.201:995
71.163.222.203:443
72.204.242.138:53
93.149.253.201:2222
108.30.125.94:443
84.247.55.190:443
89.42.142.35:443
98.16.204.189:995
45.32.155.12:2222
72.204.242.138:32102
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wporiwa.exewporiwa.exepid process 1460 wporiwa.exe 1624 wporiwa.exe -
Loads dropped DLL 2 IoCs
Processes:
19.gif.exepid process 1608 19.gif.exe 1608 19.gif.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
19.gif.exe19.gif.exewporiwa.exewporiwa.exeexplorer.exe19.gif.exepid process 1608 19.gif.exe 1712 19.gif.exe 1712 19.gif.exe 1460 wporiwa.exe 1624 wporiwa.exe 1624 wporiwa.exe 1228 explorer.exe 1228 explorer.exe 112 19.gif.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
wporiwa.exepid process 1460 wporiwa.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
19.gif.exewporiwa.exetaskeng.exedescription pid process target process PID 1608 wrote to memory of 1712 1608 19.gif.exe 19.gif.exe PID 1608 wrote to memory of 1712 1608 19.gif.exe 19.gif.exe PID 1608 wrote to memory of 1712 1608 19.gif.exe 19.gif.exe PID 1608 wrote to memory of 1712 1608 19.gif.exe 19.gif.exe PID 1608 wrote to memory of 1460 1608 19.gif.exe wporiwa.exe PID 1608 wrote to memory of 1460 1608 19.gif.exe wporiwa.exe PID 1608 wrote to memory of 1460 1608 19.gif.exe wporiwa.exe PID 1608 wrote to memory of 1460 1608 19.gif.exe wporiwa.exe PID 1608 wrote to memory of 1232 1608 19.gif.exe schtasks.exe PID 1608 wrote to memory of 1232 1608 19.gif.exe schtasks.exe PID 1608 wrote to memory of 1232 1608 19.gif.exe schtasks.exe PID 1608 wrote to memory of 1232 1608 19.gif.exe schtasks.exe PID 1460 wrote to memory of 1624 1460 wporiwa.exe wporiwa.exe PID 1460 wrote to memory of 1624 1460 wporiwa.exe wporiwa.exe PID 1460 wrote to memory of 1624 1460 wporiwa.exe wporiwa.exe PID 1460 wrote to memory of 1624 1460 wporiwa.exe wporiwa.exe PID 1460 wrote to memory of 1228 1460 wporiwa.exe explorer.exe PID 1460 wrote to memory of 1228 1460 wporiwa.exe explorer.exe PID 1460 wrote to memory of 1228 1460 wporiwa.exe explorer.exe PID 1460 wrote to memory of 1228 1460 wporiwa.exe explorer.exe PID 1460 wrote to memory of 1228 1460 wporiwa.exe explorer.exe PID 864 wrote to memory of 112 864 taskeng.exe 19.gif.exe PID 864 wrote to memory of 112 864 taskeng.exe 19.gif.exe PID 864 wrote to memory of 112 864 taskeng.exe 19.gif.exe PID 864 wrote to memory of 112 864 taskeng.exe 19.gif.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exe"C:\Users\Admin\AppData\Local\Temp\19.gif.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pvuvyinrrw /tr "\"C:\Users\Admin\AppData\Local\Temp\19.gif.exe\" /I pvuvyinrrw" /SC ONCE /Z /ST 07:00 /ET 07:122⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {D110FF84-A707-4D56-98A3-86EA06777784} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /I pvuvyinrrw2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.datMD5
ae212c4c08c7d983c4f29f995f574310
SHA1c7529b6ffffd17f35b32e2b662f80dc20efd9bc1
SHA256784e033c392993ca556bbee0b4536f6504000e697700b8328ae1bca4809c21a9
SHA512b6da0d10b4a3900ea6c9a570aa97b32370e25e00751afc3dd645b5303e42bd1775d9ec5b8e90c6586d7d22e3674ec9fee0a3c69e9308477c704c47d7660add95
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
\Users\Admin\AppData\Roaming\Microsoft\Llpxlgaemiae\wporiwa.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
memory/112-87-0x0000000000000000-mapping.dmp
-
memory/1228-85-0x0000000000150000-0x000000000017E000-memory.dmpFilesize
184KB
-
memory/1228-84-0x00000000000E0000-0x0000000000117000-memory.dmpFilesize
220KB
-
memory/1228-83-0x0000000074481000-0x0000000074483000-memory.dmpFilesize
8KB
-
memory/1228-81-0x0000000000000000-mapping.dmp
-
memory/1232-71-0x0000000000000000-mapping.dmp
-
memory/1460-74-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1460-69-0x0000000000000000-mapping.dmp
-
memory/1608-60-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1608-62-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1608-61-0x0000000000220000-0x0000000000254000-memory.dmpFilesize
208KB
-
memory/1624-76-0x0000000000000000-mapping.dmp
-
memory/1712-63-0x0000000000000000-mapping.dmp