Task
task1
Sample
2.bin.exe
Resource
win7v191014
0 signatures
General
- Target 2.bin
- Sample191111-mgrgp545yx
- SHA256 7d4d207fb5258f504d3f9ef60d431332d1e7320d5849c0b0acf624612b01c8f0
Score
N/A
Malware Config
Extracted
Family
-
qakbot
Campaign
-
1573123220
C2
-
206.51.202.106:50003
-
173.3.132.17:995
-
75.131.72.82:443
-
68.238.144.55:443
-
100.4.185.8:443
-
5.182.39.156:443
-
24.201.68.105:2078
-
23.240.185.215:443
-
69.92.54.95:995
-
68.131.9.203:443
-
187.163.139.200:993
-
75.81.25.223:995
-
32.208.1.239:443
-
170.10.78.48:443
-
74.194.4.181:443
-
81.147.42.195:2222
-
71.30.56.170:443
-
174.16.234.171:993
-
66.214.75.176:443
-
47.153.115.154:443
-
75.175.209.163:995
-
72.213.98.233:443
-
173.22.120.11:2222
-
68.238.56.27:443
-
184.180.157.203:2222
-
24.203.64.26:2222
-
47.153.115.154:995
-
64.19.74.29:995
-
104.32.185.213:2222
-
104.3.91.20:995
-
107.12.140.181:443
-
67.5.33.229:2078
-
67.10.18.112:993
-
80.14.209.42:2222
-
184.74.101.234:995
-
172.78.45.13:995
-
181.14.188.8:443
-
106.51.0.228:443
-
67.246.16.250:995
-
75.110.250.89:443
-
50.78.93.74:995
-
104.175.193.24:443
-
209.182.122.217:443
-
47.23.101.26:993
-
12.5.37.3:995
-
24.30.71.200:443
-
72.29.181.77:2078
-
90.43.6.185:2222
-
81.149.189.61:8443
-
5.89.115.73:2222
-
71.93.60.90:443
-
72.46.151.196:995
-
105.246.77.129:995
-
50.246.229.50:443
-
65.16.241.150:443
-
197.86.194.53:995
-
75.142.59.167:443
-
107.12.131.249:443
-
70.74.159.126:2222
-
75.130.117.134:443
-
47.202.98.230:443
-
47.214.144.253:443
-
196.194.28.127:2222
-
182.56.87.205:995
-
2.50.41.185:443
-
217.162.149.212:443
-
76.116.128.81:443
-
107.184.252.92:443
-
69.170.237.82:995
-
75.110.90.155:443
-
166.62.180.194:2078
-
62.103.70.217:995
-
108.45.183.59:443
-
67.87.38.242:2222
-
117.223.144.228:995
-
47.153.115.154:443
-
186.47.208.238:50000
-
108.5.34.128:443
-
67.77.162.13:443
-
65.30.12.240:443
-
76.80.66.226:443
-
111.125.70.30:2222
-
181.197.195.138:995
-
173.29.144.30:443
-
174.130.203.235:443
-
162.244.224.166:443
-
104.34.122.18:443
-
199.126.92.231:995
-
173.178.129.3:990
-
12.176.32.146:443
-
93.177.144.236:443
-
108.227.161.27:443
-
72.16.212.107:995
-
205.250.79.62:443
-
201.152.218.64:995
-
200.104.249.67:443
-
123.252.128.47:443
-
73.226.220.56:443
-
181.126.80.118:443
-
88.200.217.162:21
-
108.160.123.244:443
-
67.214.201.117:2222
-
173.247.186.90:443
-
50.247.230.33:443
-
75.165.181.122:443
-
68.174.15.223:443
-
96.59.11.86:443
-
71.77.231.251:443
-
24.184.6.58:2222
-
174.131.181.120:995
-
207.162.184.228:443
-
173.178.129.3:443
-
47.23.101.26:465
-
12.5.37.3:443
-
206.51.202.106:50002
-
75.131.72.82:995
-
172.251.77.230:443
-
174.48.72.160:443
-
2.177.101.143:443
-
70.120.151.69:443
-
47.146.169.85:443
-
24.93.168.38:443
-
75.70.218.193:443
-
162.244.225.30:443
-
168.245.228.71:443
-
72.29.181.77:2083
-
112.171.126.153:443
-
75.131.72.82:2087
-
96.35.170.82:2222
-
24.27.82.216:2222
-
2.50.170.151:443
-
73.202.121.222:0
-
98.155.154.220:443
-
98.148.177.77:443
-
24.180.7.155:443
-
47.155.19.205:443
-
67.160.63.127:443
-
201.188.17.26:443
-
75.165.132.69:443
-
24.182.53.191:443
-
137.25.72.175:443
-
116.58.100.130:443
-
73.37.61.237:443
-
76.169.19.193:443
-
203.83.20.209:995
-
76.174.122.204:443
-
83.79.2.218:2222
-
71.90.241.69:443
-
66.51.231.183:443
-
45.37.57.119:2222
Signatures
-
pid Process 816 PING.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1424 2.bin.exe 1108 2.bin.exe 1988 vanqawu.exe 280 vanqawu.exe 756 explorer.exe 2040 2.bin.exe 1136 vanqawu.exe 1784 vanqawu.exe - Loads dropped DLL 2 IoCs
pid Process 1424 2.bin.exe 2040 2.bin.exe - Executes dropped EXE 4 IoCs
pid Process 1988 vanqawu.exe 280 vanqawu.exe 1136 vanqawu.exe 1784 vanqawu.exe - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\ongeio = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" 756 explorer.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 1332 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 2004 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" 476 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" 1168 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 580 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 1776 reg.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1108 1424 2.bin.exe 27 PID 1424 wrote to memory of 1988 1424 2.bin.exe 28 PID 1424 wrote to memory of 2032 1424 2.bin.exe 29 PID 1988 wrote to memory of 280 1988 vanqawu.exe 31 PID 1988 wrote to memory of 756 1988 vanqawu.exe 32 PID 1636 wrote to memory of 2040 1636 taskeng.exe 34 PID 2040 wrote to memory of 1332 2040 2.bin.exe 35 PID 2040 wrote to memory of 2004 2040 2.bin.exe 37 PID 2040 wrote to memory of 1196 2040 2.bin.exe 39 PID 2040 wrote to memory of 1700 2040 2.bin.exe 41 PID 2040 wrote to memory of 476 2040 2.bin.exe 43 PID 2040 wrote to memory of 1168 2040 2.bin.exe 45 PID 2040 wrote to memory of 580 2040 2.bin.exe 47 PID 2040 wrote to memory of 1776 2040 2.bin.exe 49 PID 2040 wrote to memory of 1080 2040 2.bin.exe 51 PID 2040 wrote to memory of 1136 2040 2.bin.exe 53 PID 1136 wrote to memory of 1784 1136 vanqawu.exe 54 PID 2040 wrote to memory of 1728 2040 2.bin.exe 55 PID 2040 wrote to memory of 344 2040 2.bin.exe 57 - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1988 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" 1080 reg.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 892 conhost.exe - Uses Task Scheduler COM API 1 TTPs 12 IoCs
description ioc pid Process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 344 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 344 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 344 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 344 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 344 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 344 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 344 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 344 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 344 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 344 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 344 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 344 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.bin.exe"C:\Users\Admin\AppData\Local\Temp\2.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424
-
C:\Users\Admin\AppData\Local\Temp\2.bin.exeC:\Users\Admin\AppData\Local\Temp\2.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1988
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yscjmnq /tr "\"C:\Users\Admin\AppData\Local\Temp\2.bin.exe\" /I yscjmnq" /SC ONCE /Z /ST 11:28 /ET 11:401⤵PID:2032
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-388722206-19565585701416385159-1724534010-776757088-167748554900424385-104918526"1⤵PID:2040
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:280
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:756
-
C:\Windows\system32\taskeng.exetaskeng.exe {E7AC04B3-BA04-4C46-9EAB-DD4ACAE27AB8} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2.bin.exeC:\Users\Admin\AppData\Local\Temp\2.bin.exe /I yscjmnq1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1332
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1454323785-28609666280624240-578867336-147882620-308016459-644361413-416674330"1⤵PID:1512
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:2004
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1506634525-1632162382-104834585-2945086261389367405-636034747-14825109241439345180"1⤵PID:1312
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:1196
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-87286817511136972871951504173-2131373953-620552766-1454385770-1712220121863437355"1⤵PID:1524
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:1700
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1011713775-189621310113312756941615368287557181308-1047544927-1315538641149651406"1⤵PID:528
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:476
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "697637391-2061505081-1266413746-1942441504-2006796694-801093891-1298692984-1479197221"1⤵PID:996
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1168
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4593066861813068160-707592443934414135-14419165411353498568-13219954271054005360"1⤵PID:1576
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:580
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1740659031-20267439-340023810-65507005-16268052032082041626-1029358555185603017"1⤵PID:1796
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1776
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1273575659-1491918559-206072974570568890619856069991243092721-14993032951461137283"1⤵PID:560
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"1⤵
- Windows security bypass
PID:1080
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2130800697-9796027862012525746-1762908843-1879766864-1262307413-17245173231550736829"1⤵PID:1744
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1784
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\2.bin.exe"1⤵PID:1728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1621165976872868286-13008497892039301949-1599035643-814528698599239630-1294305660"1⤵
- Suspicious use of SetWindowsHookEx
PID:892
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN yscjmnq1⤵
- Uses Task Scheduler COM API
PID:344
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18838703051867190115-14040084561907219823-1008991383966019881-1443287144669371692"1⤵PID:1452
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:816
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1060
- T1089