Task
task1
Sample
4.bin.exe
Resource
win7v191014
0 signatures
General
- Target 4.bin
- Sample191111-57yf3bdh4j
- SHA256 29754f0caa9576eba6b9c351d20549e7e19216c6e72c2963da33450719a51277
Score
N/A
Malware Config
Extracted
Family
-
qakbot
Campaign
-
1573123220
C2
-
206.51.202.106:50003
-
173.3.132.17:995
-
75.131.72.82:443
-
68.238.144.55:443
-
100.4.185.8:443
-
5.182.39.156:443
-
24.201.68.105:2078
-
23.240.185.215:443
-
69.92.54.95:995
-
68.131.9.203:443
-
187.163.139.200:993
-
75.81.25.223:995
-
32.208.1.239:443
-
170.10.78.48:443
-
74.194.4.181:443
-
81.147.42.195:2222
-
71.30.56.170:443
-
174.16.234.171:993
-
66.214.75.176:443
-
47.153.115.154:443
-
75.175.209.163:995
-
72.213.98.233:443
-
173.22.120.11:2222
-
68.238.56.27:443
-
184.180.157.203:2222
-
24.203.64.26:2222
-
47.153.115.154:995
-
64.19.74.29:995
-
104.32.185.213:2222
-
104.3.91.20:995
-
107.12.140.181:443
-
67.5.33.229:2078
-
67.10.18.112:993
-
80.14.209.42:2222
-
184.74.101.234:995
-
172.78.45.13:995
-
181.14.188.8:443
-
106.51.0.228:443
-
67.246.16.250:995
-
75.110.250.89:443
-
50.78.93.74:995
-
104.175.193.24:443
-
209.182.122.217:443
-
47.23.101.26:993
-
12.5.37.3:995
-
24.30.71.200:443
-
72.29.181.77:2078
-
90.43.6.185:2222
-
81.149.189.61:8443
-
5.89.115.73:2222
-
71.93.60.90:443
-
72.46.151.196:995
-
105.246.77.129:995
-
50.246.229.50:443
-
65.16.241.150:443
-
197.86.194.53:995
-
75.142.59.167:443
-
107.12.131.249:443
-
70.74.159.126:2222
-
75.130.117.134:443
-
47.202.98.230:443
-
47.214.144.253:443
-
196.194.28.127:2222
-
182.56.87.205:995
-
2.50.41.185:443
-
217.162.149.212:443
-
76.116.128.81:443
-
107.184.252.92:443
-
69.170.237.82:995
-
75.110.90.155:443
-
166.62.180.194:2078
-
62.103.70.217:995
-
108.45.183.59:443
-
67.87.38.242:2222
-
117.223.144.228:995
-
47.153.115.154:443
-
186.47.208.238:50000
-
108.5.34.128:443
-
67.77.162.13:443
-
65.30.12.240:443
-
76.80.66.226:443
-
111.125.70.30:2222
-
181.197.195.138:995
-
173.29.144.30:443
-
174.130.203.235:443
-
162.244.224.166:443
-
104.34.122.18:443
-
199.126.92.231:995
-
173.178.129.3:990
-
12.176.32.146:443
-
93.177.144.236:443
-
108.227.161.27:443
-
72.16.212.107:995
-
205.250.79.62:443
-
201.152.218.64:995
-
200.104.249.67:443
-
123.252.128.47:443
-
73.226.220.56:443
-
181.126.80.118:443
-
88.200.217.162:21
-
108.160.123.244:443
-
67.214.201.117:2222
-
173.247.186.90:443
-
50.247.230.33:443
-
75.165.181.122:443
-
68.174.15.223:443
-
96.59.11.86:443
-
71.77.231.251:443
-
24.184.6.58:2222
-
174.131.181.120:995
-
207.162.184.228:443
-
173.178.129.3:443
-
47.23.101.26:465
-
12.5.37.3:443
-
206.51.202.106:50002
-
75.131.72.82:995
-
172.251.77.230:443
-
174.48.72.160:443
-
2.177.101.143:443
-
70.120.151.69:443
-
47.146.169.85:443
-
24.93.168.38:443
-
75.70.218.193:443
-
162.244.225.30:443
-
168.245.228.71:443
-
72.29.181.77:2083
-
112.171.126.153:443
-
75.131.72.82:2087
-
96.35.170.82:2222
-
24.27.82.216:2222
-
2.50.170.151:443
-
73.202.121.222:0
-
98.155.154.220:443
-
98.148.177.77:443
-
24.180.7.155:443
-
47.155.19.205:443
-
67.160.63.127:443
-
201.188.17.26:443
-
75.165.132.69:443
-
24.182.53.191:443
-
137.25.72.175:443
-
116.58.100.130:443
-
73.37.61.237:443
-
76.169.19.193:443
-
203.83.20.209:995
-
76.174.122.204:443
-
83.79.2.218:2222
-
71.90.241.69:443
-
66.51.231.183:443
-
45.37.57.119:2222
Signatures
- Uses Task Scheduler COM API 1 TTPs 12 IoCs
description ioc pid Process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1912 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1912 schtasks.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1540 conhost.exe - Executes dropped EXE 4 IoCs
pid Process 1744 vanqawu.exe 2036 vanqawu.exe 1664 vanqawu.exe 1076 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 1884 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 1808 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" 1960 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" 1880 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 1028 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 520 reg.exe - Loads dropped DLL 2 IoCs
pid Process 1272 4.bin.exe 1116 4.bin.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1744 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" 1000 reg.exe -
pid Process 1644 PING.EXE - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\anobxhk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" 1932 explorer.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1272 4.bin.exe 1292 4.bin.exe 1744 vanqawu.exe 2036 vanqawu.exe 1932 explorer.exe 1116 4.bin.exe 1664 vanqawu.exe 1076 vanqawu.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1292 1272 4.bin.exe 26 PID 1272 wrote to memory of 1744 1272 4.bin.exe 27 PID 1272 wrote to memory of 1092 1272 4.bin.exe 28 PID 1744 wrote to memory of 2036 1744 vanqawu.exe 30 PID 1744 wrote to memory of 1932 1744 vanqawu.exe 31 PID 740 wrote to memory of 1116 740 taskeng.exe 33 PID 1116 wrote to memory of 1884 1116 4.bin.exe 34 PID 1116 wrote to memory of 1808 1116 4.bin.exe 36 PID 1116 wrote to memory of 388 1116 4.bin.exe 38 PID 1116 wrote to memory of 2012 1116 4.bin.exe 40 PID 1116 wrote to memory of 1960 1116 4.bin.exe 42 PID 1116 wrote to memory of 1880 1116 4.bin.exe 44 PID 1116 wrote to memory of 1028 1116 4.bin.exe 46 PID 1116 wrote to memory of 520 1116 4.bin.exe 48 PID 1116 wrote to memory of 1000 1116 4.bin.exe 50 PID 1116 wrote to memory of 1664 1116 4.bin.exe 52 PID 1664 wrote to memory of 1076 1664 vanqawu.exe 53 PID 1116 wrote to memory of 1548 1116 4.bin.exe 54 PID 1116 wrote to memory of 1912 1116 4.bin.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exe"C:\Users\Admin\AppData\Local\Temp\4.bin.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exeC:\Users\Admin\AppData\Local\Temp\4.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bdadlxhyo /tr "\"C:\Users\Admin\AppData\Local\Temp\4.bin.exe\" /I bdadlxhyo" /SC ONCE /Z /ST 11:28 /ET 11:401⤵PID:1092
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2597591398348209951629390757-20837680671281542962-272171816-1368649592-2099165143"1⤵PID:1704
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
C:\Windows\system32\taskeng.exetaskeng.exe {61F11096-A4CA-41E6-AB61-5091EE62140C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:740
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exeC:\Users\Admin\AppData\Local\Temp\4.bin.exe /I bdadlxhyo1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1884
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "454223412-5150921471267314816971419469-320043876187068563-9496390491679250568"1⤵PID:1108
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1808
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2144050515-389075933-1508972097-173549143419327725941434069226-1501936006-520507919"1⤵PID:1640
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:388
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1533849828-300728876-5139443641488150060-813119979-795185563116803031361243198"1⤵PID:1156
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:2012
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-14326235771269299388394215760-1441725228474106955522311275-1329707027-510705780"1⤵PID:1092
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1960
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1362646698679134613-1646037335-1637149667-1728267804-6314402491359913413-1924700415"1⤵PID:1864
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1880
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1552625258-855583776-347031575-546263353-1388342382-712799299114535281-1437648811"1⤵PID:1364
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1028
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "130610099-34859375020190171027635789191422629631579713398-73928855-240523436"1⤵PID:1248
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11722155763968883212001056621-1499077304-10604749351649227884674288798-25225224"1⤵PID:268
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"1⤵
- Windows security bypass
PID:1000
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1475751690-914987179-849248526-1376750572-1231355956-1273077536-522229928-1075185013"1⤵PID:560
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4.bin.exe"1⤵PID:1548
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN bdadlxhyo1⤵
- Uses Task Scheduler COM API
PID:1912
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9727120541908570174-1643056064503861097-1069490950-1499688098-1970724049-453199473"1⤵
- Suspicious use of SetWindowsHookEx
PID:1540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2024361766-138375663415415781951794486084-1781180518285315062-14977885021195648683"1⤵PID:1008
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:1644
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1089
- T1060