Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 05:02
Static task
static1
Behavioral task
behavioral1
Sample
19.gif.exe
Resource
win7v20210408
General
-
Target
19.gif.exe
-
Size
269KB
-
MD5
336aaae4fa380c66834c8665172cf179
-
SHA1
c0a93f789ce3bb1471cce677573f05143192cc90
-
SHA256
7803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
-
SHA512
1f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
Malware Config
Extracted
qakbot
325.43
tr01
1602688146
73.228.1.246:443
74.109.219.145:443
76.111.128.194:443
90.175.88.99:2222
108.191.28.158:443
68.225.60.77:443
75.136.40.155:443
5.193.181.221:2078
72.204.242.138:20
118.160.162.234:443
68.14.210.246:22
148.101.74.12:443
74.222.204.82:443
96.30.198.161:443
140.82.27.132:443
2.50.131.64:443
45.32.155.12:995
45.63.104.123:443
45.32.165.134:443
217.162.149.212:443
207.246.70.216:443
200.75.136.78:443
187.155.58.60:443
166.62.183.139:2078
35.134.202.234:443
67.170.137.8:443
70.45.126.135:443
173.21.10.71:2222
96.247.181.229:443
76.167.240.21:443
67.165.206.193:993
71.80.66.107:443
81.98.133.106:443
190.63.182.214:443
71.197.126.250:443
71.220.191.200:443
24.71.28.247:443
71.56.53.127:443
24.43.22.220:993
81.133.234.36:2222
69.47.239.10:443
80.195.103.146:2222
78.96.199.79:443
65.131.47.228:995
86.121.121.14:2222
96.243.35.201:443
173.70.165.101:995
80.14.209.42:2222
2.51.221.138:995
76.170.77.99:995
46.53.38.174:443
68.116.193.239:443
187.213.152.50:995
50.244.112.10:995
2.88.42.65:995
69.47.26.41:443
151.73.121.31:443
108.46.145.30:443
71.187.170.235:443
75.136.26.147:443
134.0.196.46:995
98.118.156.172:443
199.116.241.147:443
75.137.239.211:443
103.238.231.35:443
74.75.216.202:443
184.21.136.237:443
71.182.142.63:443
78.97.3.6:443
108.190.151.108:2222
85.121.42.12:995
67.6.55.77:443
141.158.47.123:443
98.240.24.57:443
68.46.142.48:995
151.205.102.42:443
172.87.134.226:443
187.213.186.154:443
72.204.242.138:443
72.240.200.181:2222
72.36.59.46:2222
24.229.150.54:995
100.4.179.64:443
190.85.91.154:443
31.215.98.218:443
47.28.131.209:443
207.255.161.8:993
207.246.75.201:443
77.159.149.74:443
45.77.193.83:443
71.19.217.23:443
86.121.215.99:443
207.255.161.8:995
184.180.157.203:2222
108.35.13.206:443
24.122.0.90:443
67.209.195.198:443
68.190.152.98:443
72.204.242.138:465
65.30.213.13:6882
188.27.178.166:443
207.255.161.8:32103
186.154.182.103:443
72.190.101.70:443
208.99.100.129:443
63.155.8.102:995
178.222.13.77:995
70.123.92.175:2222
108.5.33.110:443
70.168.130.172:995
45.32.154.10:443
199.247.22.145:443
80.240.26.178:443
85.204.189.105:443
102.190.183.108:443
207.255.161.8:443
66.215.32.224:443
71.28.7.23:443
86.176.25.92:2222
61.230.0.156:443
207.255.161.8:32100
41.228.59.195:443
67.60.113.253:2222
117.218.208.239:443
206.183.190.53:993
184.98.103.204:995
134.228.24.29:443
66.97.247.15:443
72.204.242.138:50001
72.204.242.138:32100
66.26.160.37:443
86.98.89.172:2222
72.82.15.220:443
24.37.178.158:443
47.44.217.98:443
72.204.242.138:995
95.179.247.224:443
172.78.30.215:443
39.36.156.196:995
24.234.86.201:995
71.163.222.203:443
72.204.242.138:53
93.149.253.201:2222
108.30.125.94:443
84.247.55.190:443
89.42.142.35:443
98.16.204.189:995
45.32.155.12:2222
72.204.242.138:32102
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
aeote.exeaeote.exepid process 1548 aeote.exe 2720 aeote.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
19.gif.exeaeote.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 19.gif.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 19.gif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 aeote.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service aeote.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 aeote.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc aeote.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service aeote.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 19.gif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 19.gif.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 19.gif.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 19.gif.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc aeote.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
19.gif.exe19.gif.exeaeote.exeaeote.exeexplorer.exe19.gif.exepid process 3540 19.gif.exe 3540 19.gif.exe 200 19.gif.exe 200 19.gif.exe 200 19.gif.exe 200 19.gif.exe 1548 aeote.exe 1548 aeote.exe 2720 aeote.exe 2720 aeote.exe 2720 aeote.exe 2720 aeote.exe 3464 explorer.exe 3464 explorer.exe 3464 explorer.exe 3464 explorer.exe 3212 19.gif.exe 3212 19.gif.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
aeote.exepid process 1548 aeote.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
19.gif.exeaeote.exedescription pid process target process PID 3540 wrote to memory of 200 3540 19.gif.exe 19.gif.exe PID 3540 wrote to memory of 200 3540 19.gif.exe 19.gif.exe PID 3540 wrote to memory of 200 3540 19.gif.exe 19.gif.exe PID 3540 wrote to memory of 1548 3540 19.gif.exe aeote.exe PID 3540 wrote to memory of 1548 3540 19.gif.exe aeote.exe PID 3540 wrote to memory of 1548 3540 19.gif.exe aeote.exe PID 3540 wrote to memory of 2352 3540 19.gif.exe schtasks.exe PID 3540 wrote to memory of 2352 3540 19.gif.exe schtasks.exe PID 3540 wrote to memory of 2352 3540 19.gif.exe schtasks.exe PID 1548 wrote to memory of 2720 1548 aeote.exe aeote.exe PID 1548 wrote to memory of 2720 1548 aeote.exe aeote.exe PID 1548 wrote to memory of 2720 1548 aeote.exe aeote.exe PID 1548 wrote to memory of 3464 1548 aeote.exe explorer.exe PID 1548 wrote to memory of 3464 1548 aeote.exe explorer.exe PID 1548 wrote to memory of 3464 1548 aeote.exe explorer.exe PID 1548 wrote to memory of 3464 1548 aeote.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exe"C:\Users\Admin\AppData\Local\Temp\19.gif.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exeC:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exeC:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mikexek /tr "\"C:\Users\Admin\AppData\Local\Temp\19.gif.exe\" /I mikexek" /SC ONCE /Z /ST 05:08 /ET 05:202⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /I mikexek1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.datMD5
c251ea15e5d97558f20d84123343c805
SHA186870a6e40465b74e991c3fc919621d7f388d0e5
SHA2565058d70ccd27706290ecd7b6b63a3c12396857fa57b7a46ae4b75a46f19841b5
SHA5121afc4ebfbc2c4332c2e279dde75808600f59546125a99abe7ec36b0c75a05002729eb5a57a8972bd0a9588f98e1114a5e662528220f2409491210366f799c916
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Vuyrcczneeuy\aeote.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/200-116-0x0000000000000000-mapping.dmp
-
memory/200-117-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/1548-119-0x0000000000000000-mapping.dmp
-
memory/2352-122-0x0000000000000000-mapping.dmp
-
memory/2720-125-0x0000000000000000-mapping.dmp
-
memory/2720-127-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/3464-129-0x0000000000000000-mapping.dmp
-
memory/3464-130-0x0000000000B00000-0x0000000000B37000-memory.dmpFilesize
220KB
-
memory/3464-131-0x0000000000ED0000-0x0000000000FA1000-memory.dmpFilesize
836KB
-
memory/3540-114-0x0000000002050000-0x0000000002084000-memory.dmpFilesize
208KB
-
memory/3540-115-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB