flash

Statement from QNB.exe

Status: finished
Submission Time: 24.11.2021 14:05:13
Malicious
Trojan
Evader
Spyware
GuLoader MailPassView XpertRAT

Comments

Tags

  • exe

Details

  • Analysis ID:
    527846
  • API (Web) ID:
    895370
  • Analysis Started:
    24.11.2021 14:05:13
  • Analysis Finished:
    24.11.2021 14:29:22
  • MD5:
    9c8b626668e14aeb4355ea39d1520e33
  • SHA1:
    554069b1fb3a80a02840158d31c6c2826812cb40
  • SHA256:
    d63ed0450efe28d525954d84556394f21df1c2d882e74b4891492fefab00dd79
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
68/100

System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

malicious
100/100

IPs

IP Country Detection
194.85.248.156
Russian Federation
142.250.185.78
United States
172.217.168.14
United States
Click to see the 1 hidden entries
142.250.186.97
United States

Domains

Name IP Detection
z1s.us.to
194.85.248.156
docs.google.com
172.217.168.14
drive.google.com
142.250.185.78
Click to see the 3 hidden entries
googlehosted.l.googleusercontent.com
142.250.186.97
doc-00-5k-docs.googleusercontent.com
0.0.0.0
doc-0k-48-docs.googleusercontent.com
0.0.0.0

URLs

Name Detection
z1s.us.to:5344
https://doc-0k-48-docs.googleusercontent.com/qr
https://drive.google.com/~
Click to see the 37 hidden entries
https://drive.google.com/J4
http://www.imvu.comr
https://doc-00-5k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/9ika2j8t7trtq51k7nrgujctt9nrsl81/1637759700000/06007705055686197661/*/1yzh40PNS32XieWw_X1Kb4gxhZiPD-fNp?e=download
http://www.imvu.com/
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentSignerHttp/external
https://doc-00-5k-docs.googleusercontent.com/
https://docs.google.com/nonceSigner?nonce=1h1o0go4qslkm&continue=https://doc-0k-48-docs.googleuserco
http://www.imvu.com
https://drive.google.com/0By
https://docs.google.com/nonceSigner?nonce=1h1o0go4qslkm&continue=https://doc-0k-48-docs.googleusercontent.com/docs/securesc/35sumvj0vue2ri2uv2ecasddg28mcdkj/ad6glr8l0h99hqpngtfni6a8i22nv65q/1637759775000/06007705055686197661/09438607504833105235Z/1yzh40PNS32XieWw_X1Kb4gxhZiPD-fNp?e%3Ddownload&hash=pckr7av56kdraffkce6aepv1b87ssmgu
https://doc-00-5k-docs.googleusercontent.com/%%doc-00-5k-docs.googleusercontent.com
https://doc-0k-48-docs.googleusercontent.com/
https://drive.google.com/M
https://doc-0k-48-docs.googleusercontent.com/Od
https://drive.google.com/J
https://doc-0k-48-docs.googleusercontent.com/docs/securesc/35sumvj0vue2ri2uv2ecasddg28mcdkj/ad6glr8l0h99hqpngtfni6a8i22nv65q/1637759775000/06007705055686197661/09438607504833105235Z/1yzh40PNS32XieWw_X1Kb4gxhZiPD-fNp?e=download&nonce=1h1o0go4qslkm&user=09438607504833105235Z&hash=0o6b323c0rq74tch8ch7someetivr76b
https://docs.google.com/b5
https://drive.google.com/F
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
https://doc-0k-48-docs.googleusercontent.com/%%doc-0k-48-docs.googleusercontent.com
https://www.google.com
https://doc-00-5k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/9ika2j8t
https://doc-0k-48-docs.googleusercontent.com/~
http://www.google.com/support/accounts/answer/151657?hl=en
https://drive.google.com/
https://drive.google.com/T
https://doc-0k-48-docs.googleusercontent.com/v
https://doc-0k-48-docs.googleusercontent.com/3
https://docs.google.com/:5
https://www.google.com/accounts/servicelogin
https://login.yahoo.com/config/login
https://doc-0k-48-docs.googleusercontent.com/docs/securesc/35sumvj0vue2ri2uv2ecasddg28mcdkj/ad6glr8l
https://doc-0k-48-docs.googleusercontent.com/docs/securesc/35sumvj0vue2ri2uv2ecasddg28mcdkj/ad6glr8l0h99hqpngtfni6a8i22nv65q/1637759775000/06007705055686197661/09438607504833105235Z/1yzh40PNS32XieWw_X1Kb4gxhZiPD-fNp?e=download
http://www.nirsoft.net/
http://www.imvu.comata
http://www.ebuddy.com
https://csp.withgoogle.com/csp/report-to/gse_l9ocaq

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\computer+user.bmp
PC bitmap, Windows 3.x format, 448 x 448 x 24
#
C:\Users\user\AppData\Local\Temp\bhvD2BB.tmp
Extensible storage engine DataBase, version 0x620, checksum 0xbfe3589f, page size 32768, DirtyShutdown, Windows version 10.0
#
Click to see the 13 hidden entries
C:\Users\user\AppData\Local\Temp\~DF3CDB9B0E0AB3B377.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF4E2873A32C413EC3.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF5493C8EC3A096669.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF93F550DD9A770457.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DF9D094ABC44AE1A89.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DFB962B4444FDFF0CF.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DFB9E9D901A47CB813.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\~DFDDED18805B00B83E.TMP
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4
data
#
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4.pas
data
#
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\nyuimqkss2.txt
Little-endian UTF-16 Unicode text, with no line terminators
#
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\nyuimqkss4.txt
Little-endian UTF-16 Unicode text, with no line terminators
#
C:\Users\user\AppData\Roaming\D7I2A8S6-B3Y1-J1N8-O887-M0I1C4O6V0D4\ut
PC bitmap, Windows 3.x format, 448 x 448 x 24
#