Analysis
-
max time kernel
135s -
max time network
121s -
resource
win7v191014
Task
task1
Sample
4.bin.exe
Resource
win7v191014
0 signatures
General
-
Target
4.bin
-
Sample
191111-57yf3bdh4j
-
SHA256
29754f0caa9576eba6b9c351d20549e7e19216c6e72c2963da33450719a51277
Score
N/A
Malware Config
Extracted
Family
qakbot
Campaign
1573123220
C2
206.51.202.106:50003
173.3.132.17:995
75.131.72.82:443
68.238.144.55:443
100.4.185.8:443
5.182.39.156:443
24.201.68.105:2078
23.240.185.215:443
69.92.54.95:995
68.131.9.203:443
187.163.139.200:993
75.81.25.223:995
32.208.1.239:443
170.10.78.48:443
74.194.4.181:443
81.147.42.195:2222
71.30.56.170:443
174.16.234.171:993
66.214.75.176:443
47.153.115.154:443
75.175.209.163:995
72.213.98.233:443
173.22.120.11:2222
68.238.56.27:443
184.180.157.203:2222
24.203.64.26:2222
47.153.115.154:995
64.19.74.29:995
104.32.185.213:2222
104.3.91.20:995
107.12.140.181:443
67.5.33.229:2078
67.10.18.112:993
80.14.209.42:2222
184.74.101.234:995
172.78.45.13:995
181.14.188.8:443
106.51.0.228:443
67.246.16.250:995
75.110.250.89:443
50.78.93.74:995
104.175.193.24:443
209.182.122.217:443
47.23.101.26:993
12.5.37.3:995
24.30.71.200:443
72.29.181.77:2078
90.43.6.185:2222
81.149.189.61:8443
5.89.115.73:2222
71.93.60.90:443
72.46.151.196:995
105.246.77.129:995
50.246.229.50:443
65.16.241.150:443
197.86.194.53:995
75.142.59.167:443
107.12.131.249:443
70.74.159.126:2222
75.130.117.134:443
47.202.98.230:443
47.214.144.253:443
196.194.28.127:2222
182.56.87.205:995
2.50.41.185:443
217.162.149.212:443
76.116.128.81:443
107.184.252.92:443
69.170.237.82:995
75.110.90.155:443
166.62.180.194:2078
62.103.70.217:995
108.45.183.59:443
67.87.38.242:2222
117.223.144.228:995
47.153.115.154:443
186.47.208.238:50000
108.5.34.128:443
67.77.162.13:443
65.30.12.240:443
76.80.66.226:443
111.125.70.30:2222
181.197.195.138:995
173.29.144.30:443
174.130.203.235:443
162.244.224.166:443
104.34.122.18:443
199.126.92.231:995
173.178.129.3:990
12.176.32.146:443
93.177.144.236:443
108.227.161.27:443
72.16.212.107:995
205.250.79.62:443
201.152.218.64:995
200.104.249.67:443
123.252.128.47:443
73.226.220.56:443
181.126.80.118:443
88.200.217.162:21
108.160.123.244:443
67.214.201.117:2222
173.247.186.90:443
50.247.230.33:443
75.165.181.122:443
68.174.15.223:443
96.59.11.86:443
71.77.231.251:443
24.184.6.58:2222
174.131.181.120:995
207.162.184.228:443
173.178.129.3:443
47.23.101.26:465
12.5.37.3:443
206.51.202.106:50002
75.131.72.82:995
172.251.77.230:443
174.48.72.160:443
2.177.101.143:443
70.120.151.69:443
47.146.169.85:443
24.93.168.38:443
75.70.218.193:443
162.244.225.30:443
168.245.228.71:443
72.29.181.77:2083
112.171.126.153:443
75.131.72.82:2087
96.35.170.82:2222
24.27.82.216:2222
2.50.170.151:443
73.202.121.222:0
98.155.154.220:443
98.148.177.77:443
24.180.7.155:443
47.155.19.205:443
67.160.63.127:443
201.188.17.26:443
75.165.132.69:443
24.182.53.191:443
137.25.72.175:443
116.58.100.130:443
73.37.61.237:443
76.169.19.193:443
203.83.20.209:995
76.174.122.204:443
83.79.2.218:2222
71.90.241.69:443
66.51.231.183:443
45.37.57.119:2222
Signatures
-
Uses Task Scheduler COM API 1 TTPs 12 IoCs
Processes:
schtasks.exedescription ioc pid Process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1912 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1912 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1912 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1912 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
conhost.exepid Process 1540 conhost.exe -
Executes dropped EXE 4 IoCs
Processes:
vanqawu.exevanqawu.exevanqawu.exevanqawu.exepid Process 1744 vanqawu.exe 2036 vanqawu.exe 1664 vanqawu.exe 1076 vanqawu.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exedescription ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 1884 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 1808 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" 1960 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" 1880 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 1028 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 520 reg.exe -
Loads dropped DLL 2 IoCs
Processes:
4.bin.exe4.bin.exepid Process 1272 4.bin.exe 1116 4.bin.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vanqawu.exepid Process 1744 vanqawu.exe -
Processes:
reg.exedescription ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" 1000 reg.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\anobxhk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" 1932 explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
4.bin.exe4.bin.exevanqawu.exevanqawu.exeexplorer.exe4.bin.exevanqawu.exevanqawu.exepid Process 1272 4.bin.exe 1292 4.bin.exe 1744 vanqawu.exe 2036 vanqawu.exe 1932 explorer.exe 1116 4.bin.exe 1664 vanqawu.exe 1076 vanqawu.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
4.bin.exevanqawu.exetaskeng.exe4.bin.exevanqawu.exedescription pid Process procid_target PID 1272 wrote to memory of 1292 1272 4.bin.exe 26 PID 1272 wrote to memory of 1744 1272 4.bin.exe 27 PID 1272 wrote to memory of 1092 1272 4.bin.exe 28 PID 1744 wrote to memory of 2036 1744 vanqawu.exe 30 PID 1744 wrote to memory of 1932 1744 vanqawu.exe 31 PID 740 wrote to memory of 1116 740 taskeng.exe 33 PID 1116 wrote to memory of 1884 1116 4.bin.exe 34 PID 1116 wrote to memory of 1808 1116 4.bin.exe 36 PID 1116 wrote to memory of 388 1116 4.bin.exe 38 PID 1116 wrote to memory of 2012 1116 4.bin.exe 40 PID 1116 wrote to memory of 1960 1116 4.bin.exe 42 PID 1116 wrote to memory of 1880 1116 4.bin.exe 44 PID 1116 wrote to memory of 1028 1116 4.bin.exe 46 PID 1116 wrote to memory of 520 1116 4.bin.exe 48 PID 1116 wrote to memory of 1000 1116 4.bin.exe 50 PID 1116 wrote to memory of 1664 1116 4.bin.exe 52 PID 1664 wrote to memory of 1076 1664 vanqawu.exe 53 PID 1116 wrote to memory of 1548 1116 4.bin.exe 54 PID 1116 wrote to memory of 1912 1116 4.bin.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exe"C:\Users\Admin\AppData\Local\Temp\4.bin.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exeC:\Users\Admin\AppData\Local\Temp\4.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bdadlxhyo /tr "\"C:\Users\Admin\AppData\Local\Temp\4.bin.exe\" /I bdadlxhyo" /SC ONCE /Z /ST 11:28 /ET 11:401⤵PID:1092
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2597591398348209951629390757-20837680671281542962-272171816-1368649592-2099165143"1⤵PID:1704
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
C:\Windows\system32\taskeng.exetaskeng.exe {61F11096-A4CA-41E6-AB61-5091EE62140C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:740
-
C:\Users\Admin\AppData\Local\Temp\4.bin.exeC:\Users\Admin\AppData\Local\Temp\4.bin.exe /I bdadlxhyo1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1884
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "454223412-5150921471267314816971419469-320043876187068563-9496390491679250568"1⤵PID:1108
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1808
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2144050515-389075933-1508972097-173549143419327725941434069226-1501936006-520507919"1⤵PID:1640
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:388
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1533849828-300728876-5139443641488150060-813119979-795185563116803031361243198"1⤵PID:1156
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:2012
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-14326235771269299388394215760-1441725228474106955522311275-1329707027-510705780"1⤵PID:1092
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1960
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1362646698679134613-1646037335-1637149667-1728267804-6314402491359913413-1924700415"1⤵PID:1864
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1880
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1552625258-855583776-347031575-546263353-1388342382-712799299114535281-1437648811"1⤵PID:1364
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1028
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "130610099-34859375020190171027635789191422629631579713398-73928855-240523436"1⤵PID:1248
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11722155763968883212001056621-1499077304-10604749351649227884674288798-25225224"1⤵PID:268
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"1⤵
- Windows security bypass
PID:1000
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1475751690-914987179-849248526-1376750572-1231355956-1273077536-522229928-1075185013"1⤵PID:560
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4.bin.exe"1⤵PID:1548
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN bdadlxhyo1⤵
- Uses Task Scheduler COM API
PID:1912
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9727120541908570174-1643056064503861097-1069490950-1499688098-1970724049-453199473"1⤵
- Suspicious use of SetWindowsHookEx
PID:1540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2024361766-138375663415415781951794486084-1781180518285315062-14977885021195648683"1⤵PID:1008
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:1644
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089
- T1060