analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

participant_628hsJI.vbs

Full analysis: https://app.any.run/tasks/817b5126-74f7-4f92-a933-090463cdd9e0
Verdict: Malicious activity
Threats:

Qbot is a banking Trojan — a malware designed to collect banking information from victims. Qbot targets organizations mostly in the US. It is equipped with various sophisticated evasion and info-stealing functions and worm-like functionality, and a strong persistence mechanism.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 01:25:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qbot
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

AB61B5BCA9355F85BCEEC5B912918C77

SHA1:

78F97CE6A5AF23B72198F70D14379441629C1ED2

SHA256:

3EB3106325431FEE81168F6ECFDE906C936EC3B6203C5A0B8998A00407C91C31

SSDEEP:

49152:M1WP80ifVQPjabNBoeLHL9T6+K3HYPlxptu1V3TXcMs8T:5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • UkfEnrN.exe (PID: 1080)
      • ytfovlym.exe (PID: 4052)
      • UkfEnrN.exe (PID: 3152)
      • ytfovlym.exe (PID: 2292)

    • QBOT was detected

      • UkfEnrN.exe (PID: 3152)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3540)
      • UkfEnrN.exe (PID: 3152)
      • cmd.exe (PID: 3112)

    • Application launched itself

      • UkfEnrN.exe (PID: 3152)
      • ytfovlym.exe (PID: 4052)

    • Starts itself from another location

      • UkfEnrN.exe (PID: 3152)

    • Creates files in the user directory

      • UkfEnrN.exe (PID: 3152)

    • Executed via WMI

      • UkfEnrN.exe (PID: 3152)

    • Starts CMD.EXE for commands execution

      • UkfEnrN.exe (PID: 3152)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • cmd.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
8
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start wscript.exe #QBOT ukfenrn.exe ukfenrn.exe no specs ytfovlym.exe no specs cmd.exe ping.exe no specs ytfovlym.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3540"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\participant_628hsJI.vbs"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3152C:\Users\admin\AppData\Local\Temp\UkfEnrN.exeC:\Users\admin\AppData\Local\Temp\UkfEnrN.exe
wmiprvse.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Access Bridge for Windows Java Access Bridge for Windows Java Access Bridge for Windows
Exit code:
0
Version:
2, 0, 4, 0
1080C:\Users\admin\AppData\Local\Temp\UkfEnrN.exe /CC:\Users\admin\AppData\Local\Temp\UkfEnrN.exe—UkfEnrN.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Access Bridge for Windows Java Access Bridge for Windows Java Access Bridge for Windows
Exit code:
0
Version:
2, 0, 4, 0
4052C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe—UkfEnrN.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Access Bridge for Windows Java Access Bridge for Windows Java Access Bridge for Windows
Exit code:
0
Version:
2, 0, 4, 0
3112"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\admin\AppData\Local\Temp\UkfEnrN.exe"C:\Windows\System32\cmd.exe
UkfEnrN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3852ping.exe -n 6 127.0.0.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2292C:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe /CC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exe—ytfovlym.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Access Bridge for Windows Java Access Bridge for Windows Java Access Bridge for Windows
Exit code:
0
Version:
2, 0, 4, 0
3768C:\Windows\explorer.exeC:\Windows\explorer.exe—ytfovlym.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
99
Read events
95
Write events
4
Delete events
0

Modification events

(PID) Process:(3152) UkfEnrN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3152) UkfEnrN.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
3
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3540WScript.exeC:\Users\admin\AppData\Local\Temp\VTUbUgNxtext
MD5:2EAB64D443B539C5697536F6E0D24F87
SHA256:D4008BA740B0715C594F7EC4CD0662EBA4D3F60C77131A023FB06CB1EF276A4A
3540WScript.exeC:\Users\admin\AppData\Local\Temp\UkfEnrN.exeexecutable
MD5:B568AFE398DB63E74AE6C53DFF0D71A1
SHA256:BCB7060168BCCB934FDE12225A3F02635C9B8E446A8519BB44F46FFD4C638535
3768explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.datbinary
MD5:039492E9544DE2C3ED8B2321DDC45693
SHA256:2A9214A198F212F0DBBF8A6BFBAE02C18CFD6FC21AE2912FBEE46A8DA72A7A17
3152UkfEnrN.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.exeexecutable
MD5:B568AFE398DB63E74AE6C53DFF0D71A1
SHA256:BCB7060168BCCB934FDE12225A3F02635C9B8E446A8519BB44F46FFD4C638535
3152UkfEnrN.exeC:\Users\admin\AppData\Roaming\Microsoft\Zulycjadyc\ytfovlym.datbinary
MD5:AF644F8BC6FD8902F1153AFE43E894AE
SHA256:9DDBBB70F644C3D1863761A9662250D3640D096EAD5892D52BB2235E504848FB
3112cmd.exeC:\Users\admin\AppData\Local\Temp\UkfEnrN.exeexecutable
MD5:60B7C0FEAD45F2066E5B805A91F4F0FC
SHA256:80C10EE5F21F92F89CBC293A59D2FD4C01C7958AACAD15642558DB700943FA22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
participant_628hsJI.vbs