Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 04:43
Static task
static1
Behavioral task
behavioral1
Sample
19.gif.exe
Resource
win7v20210410
General
-
Target
19.gif.exe
-
Size
269KB
-
MD5
336aaae4fa380c66834c8665172cf179
-
SHA1
c0a93f789ce3bb1471cce677573f05143192cc90
-
SHA256
7803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
-
SHA512
1f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
Malware Config
Extracted
qakbot
325.43
tr01
1602688146
73.228.1.246:443
74.109.219.145:443
76.111.128.194:443
90.175.88.99:2222
108.191.28.158:443
68.225.60.77:443
75.136.40.155:443
5.193.181.221:2078
72.204.242.138:20
118.160.162.234:443
68.14.210.246:22
148.101.74.12:443
74.222.204.82:443
96.30.198.161:443
140.82.27.132:443
2.50.131.64:443
45.32.155.12:995
45.63.104.123:443
45.32.165.134:443
217.162.149.212:443
207.246.70.216:443
200.75.136.78:443
187.155.58.60:443
166.62.183.139:2078
35.134.202.234:443
67.170.137.8:443
70.45.126.135:443
173.21.10.71:2222
96.247.181.229:443
76.167.240.21:443
67.165.206.193:993
71.80.66.107:443
81.98.133.106:443
190.63.182.214:443
71.197.126.250:443
71.220.191.200:443
24.71.28.247:443
71.56.53.127:443
24.43.22.220:993
81.133.234.36:2222
69.47.239.10:443
80.195.103.146:2222
78.96.199.79:443
65.131.47.228:995
86.121.121.14:2222
96.243.35.201:443
173.70.165.101:995
80.14.209.42:2222
2.51.221.138:995
76.170.77.99:995
46.53.38.174:443
68.116.193.239:443
187.213.152.50:995
50.244.112.10:995
2.88.42.65:995
69.47.26.41:443
151.73.121.31:443
108.46.145.30:443
71.187.170.235:443
75.136.26.147:443
134.0.196.46:995
98.118.156.172:443
199.116.241.147:443
75.137.239.211:443
103.238.231.35:443
74.75.216.202:443
184.21.136.237:443
71.182.142.63:443
78.97.3.6:443
108.190.151.108:2222
85.121.42.12:995
67.6.55.77:443
141.158.47.123:443
98.240.24.57:443
68.46.142.48:995
151.205.102.42:443
172.87.134.226:443
187.213.186.154:443
72.204.242.138:443
72.240.200.181:2222
72.36.59.46:2222
24.229.150.54:995
100.4.179.64:443
190.85.91.154:443
31.215.98.218:443
47.28.131.209:443
207.255.161.8:993
207.246.75.201:443
77.159.149.74:443
45.77.193.83:443
71.19.217.23:443
86.121.215.99:443
207.255.161.8:995
184.180.157.203:2222
108.35.13.206:443
24.122.0.90:443
67.209.195.198:443
68.190.152.98:443
72.204.242.138:465
65.30.213.13:6882
188.27.178.166:443
207.255.161.8:32103
186.154.182.103:443
72.190.101.70:443
208.99.100.129:443
63.155.8.102:995
178.222.13.77:995
70.123.92.175:2222
108.5.33.110:443
70.168.130.172:995
45.32.154.10:443
199.247.22.145:443
80.240.26.178:443
85.204.189.105:443
102.190.183.108:443
207.255.161.8:443
66.215.32.224:443
71.28.7.23:443
86.176.25.92:2222
61.230.0.156:443
207.255.161.8:32100
41.228.59.195:443
67.60.113.253:2222
117.218.208.239:443
206.183.190.53:993
184.98.103.204:995
134.228.24.29:443
66.97.247.15:443
72.204.242.138:50001
72.204.242.138:32100
66.26.160.37:443
86.98.89.172:2222
72.82.15.220:443
24.37.178.158:443
47.44.217.98:443
72.204.242.138:995
95.179.247.224:443
172.78.30.215:443
39.36.156.196:995
24.234.86.201:995
71.163.222.203:443
72.204.242.138:53
93.149.253.201:2222
108.30.125.94:443
84.247.55.190:443
89.42.142.35:443
98.16.204.189:995
45.32.155.12:2222
72.204.242.138:32102
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ghjboux.exeghjboux.exepid process 1200 ghjboux.exe 972 ghjboux.exe -
Loads dropped DLL 2 IoCs
Processes:
19.gif.exepid process 1676 19.gif.exe 1676 19.gif.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
19.gif.exe19.gif.exeghjboux.exeghjboux.exeexplorer.exe19.gif.exepid process 1676 19.gif.exe 1280 19.gif.exe 1280 19.gif.exe 1200 ghjboux.exe 972 ghjboux.exe 972 ghjboux.exe 740 explorer.exe 740 explorer.exe 1456 19.gif.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ghjboux.exepid process 1200 ghjboux.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
19.gif.exeghjboux.exetaskeng.exedescription pid process target process PID 1676 wrote to memory of 1280 1676 19.gif.exe 19.gif.exe PID 1676 wrote to memory of 1280 1676 19.gif.exe 19.gif.exe PID 1676 wrote to memory of 1280 1676 19.gif.exe 19.gif.exe PID 1676 wrote to memory of 1280 1676 19.gif.exe 19.gif.exe PID 1676 wrote to memory of 1200 1676 19.gif.exe ghjboux.exe PID 1676 wrote to memory of 1200 1676 19.gif.exe ghjboux.exe PID 1676 wrote to memory of 1200 1676 19.gif.exe ghjboux.exe PID 1676 wrote to memory of 1200 1676 19.gif.exe ghjboux.exe PID 1676 wrote to memory of 1584 1676 19.gif.exe schtasks.exe PID 1676 wrote to memory of 1584 1676 19.gif.exe schtasks.exe PID 1676 wrote to memory of 1584 1676 19.gif.exe schtasks.exe PID 1676 wrote to memory of 1584 1676 19.gif.exe schtasks.exe PID 1200 wrote to memory of 972 1200 ghjboux.exe ghjboux.exe PID 1200 wrote to memory of 972 1200 ghjboux.exe ghjboux.exe PID 1200 wrote to memory of 972 1200 ghjboux.exe ghjboux.exe PID 1200 wrote to memory of 972 1200 ghjboux.exe ghjboux.exe PID 1200 wrote to memory of 740 1200 ghjboux.exe explorer.exe PID 1200 wrote to memory of 740 1200 ghjboux.exe explorer.exe PID 1200 wrote to memory of 740 1200 ghjboux.exe explorer.exe PID 1200 wrote to memory of 740 1200 ghjboux.exe explorer.exe PID 1200 wrote to memory of 740 1200 ghjboux.exe explorer.exe PID 904 wrote to memory of 1456 904 taskeng.exe 19.gif.exe PID 904 wrote to memory of 1456 904 taskeng.exe 19.gif.exe PID 904 wrote to memory of 1456 904 taskeng.exe 19.gif.exe PID 904 wrote to memory of 1456 904 taskeng.exe 19.gif.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exe"C:\Users\Admin\AppData\Local\Temp\19.gif.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeC:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeC:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ytrdfgqpoc /tr "\"C:\Users\Admin\AppData\Local\Temp\19.gif.exe\" /I ytrdfgqpoc" /SC ONCE /Z /ST 04:49 /ET 05:012⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {1FDE8F07-C4DF-4444-9147-2BC9B00B8F40} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19.gif.exeC:\Users\Admin\AppData\Local\Temp\19.gif.exe /I ytrdfgqpoc2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.datMD5
a8282ff7add57c5bd9bde6958b6df91f
SHA116e7a6db1385e74c95903aed5f75c8cd314c1658
SHA2567aede93365e1b4bd93fc2b81eb51551fce60fd322b557ce933ad8fd0e3044517
SHA512bfff6891053d5f3440df201e7104a9f90dbca4af408f0014cf695190448d9fdcdc0a72570e7a306ed49ca9c1e82c302bcd46ff62edaa50f4b8f4a34a4db1fbca
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
C:\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
\Users\Admin\AppData\Roaming\Microsoft\Msieeyoqllae\ghjboux.exeMD5
336aaae4fa380c66834c8665172cf179
SHA1c0a93f789ce3bb1471cce677573f05143192cc90
SHA2567803a0cfd5572aa9d9e3d60b071a26497823bff93f4f656f9d7fcfea561a097f
SHA5121f7544f67da48df9f22f856d084f2adb5485639f6bd92fe0513e0f08efe6c95760dd549a8208560753a73e7db04424d5694beff171bf7946a4643fd34c225908
-
memory/740-80-0x0000000000000000-mapping.dmp
-
memory/740-84-0x00000000004B0000-0x00000000004DE000-memory.dmpFilesize
184KB
-
memory/740-83-0x0000000000370000-0x00000000003A7000-memory.dmpFilesize
220KB
-
memory/740-82-0x0000000074C71000-0x0000000074C73000-memory.dmpFilesize
8KB
-
memory/972-75-0x0000000000000000-mapping.dmp
-
memory/1200-68-0x0000000000000000-mapping.dmp
-
memory/1200-73-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1280-62-0x0000000000000000-mapping.dmp
-
memory/1456-86-0x0000000000000000-mapping.dmp
-
memory/1584-70-0x0000000000000000-mapping.dmp
-
memory/1676-61-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/1676-59-0x0000000075971000-0x0000000075973000-memory.dmpFilesize
8KB
-
memory/1676-60-0x0000000000220000-0x0000000000254000-memory.dmpFilesize
208KB