Task
task1
Sample
6.bin.exe
Resource
win7v191014
0 signatures
General
- Target 6.bin
- Sample191111-p6cqne7cwn
- SHA256 d2f8a61e8cfc9a6c983fc40d2b7ac33e2a686872d0136dce2f66466c044f246c
Score
N/A
Malware Config
Extracted
Family
-
qakbot
Campaign
-
1573123220
C2
-
206.51.202.106:50003
-
173.3.132.17:995
-
75.131.72.82:443
-
68.238.144.55:443
-
100.4.185.8:443
-
5.182.39.156:443
-
24.201.68.105:2078
-
23.240.185.215:443
-
69.92.54.95:995
-
68.131.9.203:443
-
187.163.139.200:993
-
75.81.25.223:995
-
32.208.1.239:443
-
170.10.78.48:443
-
74.194.4.181:443
-
81.147.42.195:2222
-
71.30.56.170:443
-
174.16.234.171:993
-
66.214.75.176:443
-
47.153.115.154:443
-
75.175.209.163:995
-
72.213.98.233:443
-
173.22.120.11:2222
-
68.238.56.27:443
-
184.180.157.203:2222
-
24.203.64.26:2222
-
47.153.115.154:995
-
64.19.74.29:995
-
104.32.185.213:2222
-
104.3.91.20:995
-
107.12.140.181:443
-
67.5.33.229:2078
-
67.10.18.112:993
-
80.14.209.42:2222
-
184.74.101.234:995
-
172.78.45.13:995
-
181.14.188.8:443
-
106.51.0.228:443
-
67.246.16.250:995
-
75.110.250.89:443
-
50.78.93.74:995
-
104.175.193.24:443
-
209.182.122.217:443
-
47.23.101.26:993
-
12.5.37.3:995
-
24.30.71.200:443
-
72.29.181.77:2078
-
90.43.6.185:2222
-
81.149.189.61:8443
-
5.89.115.73:2222
-
71.93.60.90:443
-
72.46.151.196:995
-
105.246.77.129:995
-
50.246.229.50:443
-
65.16.241.150:443
-
197.86.194.53:995
-
75.142.59.167:443
-
107.12.131.249:443
-
70.74.159.126:2222
-
75.130.117.134:443
-
47.202.98.230:443
-
47.214.144.253:443
-
196.194.28.127:2222
-
182.56.87.205:995
-
2.50.41.185:443
-
217.162.149.212:443
-
76.116.128.81:443
-
107.184.252.92:443
-
69.170.237.82:995
-
75.110.90.155:443
-
166.62.180.194:2078
-
62.103.70.217:995
-
108.45.183.59:443
-
67.87.38.242:2222
-
117.223.144.228:995
-
47.153.115.154:443
-
186.47.208.238:50000
-
108.5.34.128:443
-
67.77.162.13:443
-
65.30.12.240:443
-
76.80.66.226:443
-
111.125.70.30:2222
-
181.197.195.138:995
-
173.29.144.30:443
-
174.130.203.235:443
-
162.244.224.166:443
-
104.34.122.18:443
-
199.126.92.231:995
-
173.178.129.3:990
-
12.176.32.146:443
-
93.177.144.236:443
-
108.227.161.27:443
-
72.16.212.107:995
-
205.250.79.62:443
-
201.152.218.64:995
-
200.104.249.67:443
-
123.252.128.47:443
-
73.226.220.56:443
-
181.126.80.118:443
-
88.200.217.162:21
-
108.160.123.244:443
-
67.214.201.117:2222
-
173.247.186.90:443
-
50.247.230.33:443
-
75.165.181.122:443
-
68.174.15.223:443
-
96.59.11.86:443
-
71.77.231.251:443
-
24.184.6.58:2222
-
174.131.181.120:995
-
207.162.184.228:443
-
173.178.129.3:443
-
47.23.101.26:465
-
12.5.37.3:443
-
206.51.202.106:50002
-
75.131.72.82:995
-
172.251.77.230:443
-
174.48.72.160:443
-
2.177.101.143:443
-
70.120.151.69:443
-
47.146.169.85:443
-
24.93.168.38:443
-
75.70.218.193:443
-
162.244.225.30:443
-
168.245.228.71:443
-
72.29.181.77:2083
-
112.171.126.153:443
-
75.131.72.82:2087
-
96.35.170.82:2222
-
24.27.82.216:2222
-
2.50.170.151:443
-
73.202.121.222:0
-
98.155.154.220:443
-
98.148.177.77:443
-
24.180.7.155:443
-
47.155.19.205:443
-
67.160.63.127:443
-
201.188.17.26:443
-
75.165.132.69:443
-
24.182.53.191:443
-
137.25.72.175:443
-
116.58.100.130:443
-
73.37.61.237:443
-
76.169.19.193:443
-
203.83.20.209:995
-
76.174.122.204:443
-
83.79.2.218:2222
-
71.90.241.69:443
-
66.51.231.183:443
-
45.37.57.119:2222
Signatures
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1424 6.bin.exe 1116 6.bin.exe 744 vanqawu.exe 2032 vanqawu.exe 1292 explorer.exe 1068 6.bin.exe 1912 vanqawu.exe 268 vanqawu.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1116 1424 6.bin.exe 27 PID 1424 wrote to memory of 744 1424 6.bin.exe 28 PID 1424 wrote to memory of 2012 1424 6.bin.exe 29 PID 744 wrote to memory of 2032 744 vanqawu.exe 31 PID 744 wrote to memory of 1292 744 vanqawu.exe 32 PID 1844 wrote to memory of 1068 1844 taskeng.exe 36 PID 1068 wrote to memory of 1716 1068 6.bin.exe 37 PID 1068 wrote to memory of 1736 1068 6.bin.exe 39 PID 1068 wrote to memory of 1584 1068 6.bin.exe 41 PID 1068 wrote to memory of 1920 1068 6.bin.exe 43 PID 1068 wrote to memory of 672 1068 6.bin.exe 45 PID 1068 wrote to memory of 864 1068 6.bin.exe 47 PID 1068 wrote to memory of 1104 1068 6.bin.exe 49 PID 1068 wrote to memory of 1588 1068 6.bin.exe 51 PID 1068 wrote to memory of 632 1068 6.bin.exe 53 PID 1068 wrote to memory of 1912 1068 6.bin.exe 55 PID 1912 wrote to memory of 268 1912 vanqawu.exe 56 PID 1068 wrote to memory of 1400 1068 6.bin.exe 57 PID 1068 wrote to memory of 1624 1068 6.bin.exe 58 - Loads dropped DLL 2 IoCs
pid Process 1424 6.bin.exe 1068 6.bin.exe - Executes dropped EXE 4 IoCs
pid Process 744 vanqawu.exe 2032 vanqawu.exe 1912 vanqawu.exe 268 vanqawu.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 744 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 1716 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 1736 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" 672 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" 864 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 1104 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 1588 reg.exe - Uses Task Scheduler COM API 1 TTPs 12 IoCs
description ioc pid Process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1624 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1624 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1624 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1624 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1624 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1624 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1624 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1624 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1624 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1624 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1624 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1624 schtasks.exe - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypzglov = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" 1292 explorer.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" 632 reg.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1592 conhost.exe -
pid Process 1296 PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6.bin.exe"C:\Users\Admin\AppData\Local\Temp\6.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1424
-
C:\Users\Admin\AppData\Local\Temp\6.bin.exeC:\Users\Admin\AppData\Local\Temp\6.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1116
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:744
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lmhsuxfm /tr "\"C:\Users\Admin\AppData\Local\Temp\6.bin.exe\" /I lmhsuxfm" /SC ONCE /Z /ST 11:29 /ET 11:411⤵PID:2012
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3583843111383512432-1113263077-175300447714921053544202082261384648662-1637525138"1⤵PID:1996
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2032
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:1292
-
C:\Windows\system32\taskeng.exetaskeng.exe {30628EF1-8B61-463A-AF41-09D404666DC5} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6.bin.exeC:\Users\Admin\AppData\Local\Temp\6.bin.exe /I lmhsuxfm1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1068
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1716
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2212116171845713984-506976382-11978513061783896865-63550541286389228-1212116872"1⤵PID:1156
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1736
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "9681766217812111154108611621007090101-2090015340-1887765416-669402573-174660926"1⤵PID:1564
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:1584
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-503660335-16420949411596375681204655008-1464578142745451707-1032173045-1915669089"1⤵PID:568
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:1920
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1438770199-13522963486808798511252065424-22051608-106051689819847943971740157971"1⤵PID:1672
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:672
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1803694062-1894178357-469249886-40322068786717462658523806-17458640721649668619"1⤵PID:1080
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:864
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-18900362691163701255-180027263-191913971113705516311575806158-830248627-517319222"1⤵PID:784
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1104
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2354049337483092557510356851824763568597822214-19409956063507300141315794242"1⤵PID:1984
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1588
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "523896922417461345-155263018859843531-474111941-6188026201463353251-1062902808"1⤵PID:188
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"1⤵
- Windows security bypass
PID:632
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "203133755213301950691457907166-15528422572102904581-1791759808-255816924-1433128025"1⤵PID:1948
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1912
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:268
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\6.bin.exe"1⤵PID:1400
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN lmhsuxfm1⤵
- Uses Task Scheduler COM API
PID:1624
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-13785866901405400199-94358999499271815087857745211949939901052148200-2054527250"1⤵
- Suspicious use of SetWindowsHookEx
PID:1592
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "7013647515625982311753800819-177127575-732844886-935078705-2028182276849359640"1⤵PID:724
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:1296
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1089
- T1060