Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27-08-2023 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe
Resource
win7-20230712-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe
-
Size
980KB
-
MD5
8187d85f5672ce492f00ddfdcf6fd2d5
-
SHA1
46e9385908256cf65c07399568806d73d38704a9
-
SHA256
1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2
-
SHA512
1a5f810d5ae2285757393ccac599b54bae2871c583bfec1b2c1634b01cc79027a4992aa6e0ecd56ff39dccfd97c69a61c2911a50a5249823417d746992131a1d
-
SSDEEP
6144:Vyq9ptgIsxITrY002GenQ67wk3pyJhgK8wk:RxgIsxITrL025nQopbq
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/2224-0-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 2 IoCs
pid Process 3068 Qaugauc.exe 2872 Qaugauc.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\M: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\P: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\S: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\T: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\W: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\Y: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\E: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\I: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\K: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\L: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\N: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\H: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\O: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\U: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\V: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\X: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\G: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\J: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\Q: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\R: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened (read-only) \??\Z: 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Qaugauc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Qaugauc.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe File opened for modification C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecisionReason = "1" Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecision = "0" Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecisionTime = a019da8587d8d901 Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecisionReason = "1" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48} Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecision = "0" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23 Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\7e-1b-a8-2c-d9-23 Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadNetworkName = "Network 3" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecisionReason = "1" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecisionReason = "1" Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecisionTime = a0d3088e87d8d901 Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecisionTime = a019da8587d8d901 Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\7e-1b-a8-2c-d9-23 Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecisionTime = a019da8587d8d901 Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecisionTime = a0d3088e87d8d901 Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadDecision = "0" Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDetectedUrl Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48} Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A99961F-3855-4164-966C-FBAC7B40DE48}\WpadNetworkName = "Network 3" Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Qaugauc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Qaugauc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23\WpadDecision = "0" Qaugauc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Qaugauc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1b-a8-2c-d9-23 Qaugauc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2224 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2224 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2224 1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe 3068 Qaugauc.exe 2872 Qaugauc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2872 3068 Qaugauc.exe 32 PID 3068 wrote to memory of 2872 3068 Qaugauc.exe 32 PID 3068 wrote to memory of 2872 3068 Qaugauc.exe 32 PID 3068 wrote to memory of 2872 3068 Qaugauc.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe"C:\Users\Admin\AppData\Local\Temp\1ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2224
-
C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe"C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe"C:\Program Files (x86)\Microsoft Elptjl\Qaugauc.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
980KB
MD58187d85f5672ce492f00ddfdcf6fd2d5
SHA146e9385908256cf65c07399568806d73d38704a9
SHA2561ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2
SHA5121a5f810d5ae2285757393ccac599b54bae2871c583bfec1b2c1634b01cc79027a4992aa6e0ecd56ff39dccfd97c69a61c2911a50a5249823417d746992131a1d
-
Filesize
980KB
MD58187d85f5672ce492f00ddfdcf6fd2d5
SHA146e9385908256cf65c07399568806d73d38704a9
SHA2561ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2
SHA5121a5f810d5ae2285757393ccac599b54bae2871c583bfec1b2c1634b01cc79027a4992aa6e0ecd56ff39dccfd97c69a61c2911a50a5249823417d746992131a1d
-
Filesize
980KB
MD58187d85f5672ce492f00ddfdcf6fd2d5
SHA146e9385908256cf65c07399568806d73d38704a9
SHA2561ed15783d208df1581d50087f870acf5caeac474eed4da0eb0b9968de86675d2
SHA5121a5f810d5ae2285757393ccac599b54bae2871c583bfec1b2c1634b01cc79027a4992aa6e0ecd56ff39dccfd97c69a61c2911a50a5249823417d746992131a1d