Task
task1
Sample
3.bin.exe
Resource
win7v191014
0 signatures
General
- Target 3.bin
- Sample191111-sbsq7xbqea
- SHA256 357b4979324e2065adc8e6bd11cd7161f830250cae30f50fb13edd70fd2b506b
Score
N/A
Malware Config
Extracted
Family
-
qakbot
Campaign
-
1573123220
C2
-
206.51.202.106:50003
-
173.3.132.17:995
-
75.131.72.82:443
-
68.238.144.55:443
-
100.4.185.8:443
-
5.182.39.156:443
-
24.201.68.105:2078
-
23.240.185.215:443
-
69.92.54.95:995
-
68.131.9.203:443
-
187.163.139.200:993
-
75.81.25.223:995
-
32.208.1.239:443
-
170.10.78.48:443
-
74.194.4.181:443
-
81.147.42.195:2222
-
71.30.56.170:443
-
174.16.234.171:993
-
66.214.75.176:443
-
47.153.115.154:443
-
75.175.209.163:995
-
72.213.98.233:443
-
173.22.120.11:2222
-
68.238.56.27:443
-
184.180.157.203:2222
-
24.203.64.26:2222
-
47.153.115.154:995
-
64.19.74.29:995
-
104.32.185.213:2222
-
104.3.91.20:995
-
107.12.140.181:443
-
67.5.33.229:2078
-
67.10.18.112:993
-
80.14.209.42:2222
-
184.74.101.234:995
-
172.78.45.13:995
-
181.14.188.8:443
-
106.51.0.228:443
-
67.246.16.250:995
-
75.110.250.89:443
-
50.78.93.74:995
-
104.175.193.24:443
-
209.182.122.217:443
-
47.23.101.26:993
-
12.5.37.3:995
-
24.30.71.200:443
-
72.29.181.77:2078
-
90.43.6.185:2222
-
81.149.189.61:8443
-
5.89.115.73:2222
-
71.93.60.90:443
-
72.46.151.196:995
-
105.246.77.129:995
-
50.246.229.50:443
-
65.16.241.150:443
-
197.86.194.53:995
-
75.142.59.167:443
-
107.12.131.249:443
-
70.74.159.126:2222
-
75.130.117.134:443
-
47.202.98.230:443
-
47.214.144.253:443
-
196.194.28.127:2222
-
182.56.87.205:995
-
2.50.41.185:443
-
217.162.149.212:443
-
76.116.128.81:443
-
107.184.252.92:443
-
69.170.237.82:995
-
75.110.90.155:443
-
166.62.180.194:2078
-
62.103.70.217:995
-
108.45.183.59:443
-
67.87.38.242:2222
-
117.223.144.228:995
-
47.153.115.154:443
-
186.47.208.238:50000
-
108.5.34.128:443
-
67.77.162.13:443
-
65.30.12.240:443
-
76.80.66.226:443
-
111.125.70.30:2222
-
181.197.195.138:995
-
173.29.144.30:443
-
174.130.203.235:443
-
162.244.224.166:443
-
104.34.122.18:443
-
199.126.92.231:995
-
173.178.129.3:990
-
12.176.32.146:443
-
93.177.144.236:443
-
108.227.161.27:443
-
72.16.212.107:995
-
205.250.79.62:443
-
201.152.218.64:995
-
200.104.249.67:443
-
123.252.128.47:443
-
73.226.220.56:443
-
181.126.80.118:443
-
88.200.217.162:21
-
108.160.123.244:443
-
67.214.201.117:2222
-
173.247.186.90:443
-
50.247.230.33:443
-
75.165.181.122:443
-
68.174.15.223:443
-
96.59.11.86:443
-
71.77.231.251:443
-
24.184.6.58:2222
-
174.131.181.120:995
-
207.162.184.228:443
-
173.178.129.3:443
-
47.23.101.26:465
-
12.5.37.3:443
-
206.51.202.106:50002
-
75.131.72.82:995
-
172.251.77.230:443
-
174.48.72.160:443
-
2.177.101.143:443
-
70.120.151.69:443
-
47.146.169.85:443
-
24.93.168.38:443
-
75.70.218.193:443
-
162.244.225.30:443
-
168.245.228.71:443
-
72.29.181.77:2083
-
112.171.126.153:443
-
75.131.72.82:2087
-
96.35.170.82:2222
-
24.27.82.216:2222
-
2.50.170.151:443
-
73.202.121.222:0
-
98.155.154.220:443
-
98.148.177.77:443
-
24.180.7.155:443
-
47.155.19.205:443
-
67.160.63.127:443
-
201.188.17.26:443
-
75.165.132.69:443
-
24.182.53.191:443
-
137.25.72.175:443
-
116.58.100.130:443
-
73.37.61.237:443
-
76.169.19.193:443
-
203.83.20.209:995
-
76.174.122.204:443
-
83.79.2.218:2222
-
71.90.241.69:443
-
66.51.231.183:443
-
45.37.57.119:2222
Signatures
- Uses Task Scheduler COM API 1 TTPs 12 IoCs
description ioc pid Process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1744 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1744 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1744 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1744 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1744 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1744 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1744 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1744 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1744 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1744 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1744 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1744 schtasks.exe - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\lxnybdye = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" 1344 explorer.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1328 3.bin.exe 1072 3.bin.exe 1048 vanqawu.exe 1316 vanqawu.exe 1344 explorer.exe 1252 3.bin.exe 1712 vanqawu.exe 1180 vanqawu.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1048 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" 1728 reg.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1940 conhost.exe -
pid Process 1552 PING.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1328 wrote to memory of 1072 1328 3.bin.exe 27 PID 1328 wrote to memory of 1048 1328 3.bin.exe 28 PID 1328 wrote to memory of 876 1328 3.bin.exe 29 PID 1048 wrote to memory of 1316 1048 vanqawu.exe 31 PID 1048 wrote to memory of 1344 1048 vanqawu.exe 32 PID 1976 wrote to memory of 1252 1976 taskeng.exe 34 PID 1252 wrote to memory of 1096 1252 3.bin.exe 35 PID 1252 wrote to memory of 804 1252 3.bin.exe 37 PID 1252 wrote to memory of 280 1252 3.bin.exe 39 PID 1252 wrote to memory of 1696 1252 3.bin.exe 41 PID 1252 wrote to memory of 1628 1252 3.bin.exe 43 PID 1252 wrote to memory of 1816 1252 3.bin.exe 45 PID 1252 wrote to memory of 660 1252 3.bin.exe 47 PID 1252 wrote to memory of 1004 1252 3.bin.exe 49 PID 1252 wrote to memory of 1728 1252 3.bin.exe 51 PID 1252 wrote to memory of 1712 1252 3.bin.exe 53 PID 1712 wrote to memory of 1180 1712 vanqawu.exe 54 PID 1252 wrote to memory of 1496 1252 3.bin.exe 55 PID 1252 wrote to memory of 1744 1252 3.bin.exe 57 - Loads dropped DLL 2 IoCs
pid Process 1328 3.bin.exe 1252 3.bin.exe - Executes dropped EXE 4 IoCs
pid Process 1048 vanqawu.exe 1316 vanqawu.exe 1712 vanqawu.exe 1180 vanqawu.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 1096 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 804 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" 1628 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" 1816 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 660 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 1004 reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exe"C:\Users\Admin\AppData\Local\Temp\3.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exeC:\Users\Admin\AppData\Local\Temp\3.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1048
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rwscnyojsy /tr "\"C:\Users\Admin\AppData\Local\Temp\3.bin.exe\" /I rwscnyojsy" /SC ONCE /Z /ST 11:28 /ET 11:401⤵PID:876
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1516071629593700264-61127835-14778644691860050606-971310565-1445780472-1171170408"1⤵PID:280
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1316
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:1344
-
C:\Windows\system32\taskeng.exetaskeng.exe {4D2D170B-D071-449D-9155-3B8D77EF3994} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3.bin.exeC:\Users\Admin\AppData\Local\Temp\3.bin.exe /I rwscnyojsy1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1252
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1096
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "502794666-1598125908-1215479955-93613400-11034989021907744491-1381236114-662762079"1⤵PID:1636
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:804
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-32600401417993392261348628787-107796267112059693119494748818442767471823586271"1⤵PID:108
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:280
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1593482959-11985459531883632563-1176666315-815547796-876441107-580241069-1457494758"1⤵PID:1812
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:1696
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1227852104-754096207459034605-419063946-8538568642003319501-1189689142-916354098"1⤵PID:2004
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:1628
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-231490552-113893474-705228580-142460300815992996341764395123237388048-318858093"1⤵PID:1200
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1816
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-920167257059550233627269882027365107-1872832408-777895199144587114-477730849"1⤵PID:1928
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:660
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "7778143861427410861865028884-7449193961519190321-804810712-750485344-1962660726"1⤵PID:472
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:1004
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-289569107269213694126746928616145709531058179187469072651-1636014081656927401"1⤵PID:716
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"1⤵
- Windows security bypass
PID:1728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1176538603-44071840421102203731958729532-61271478414695635879445988381080365673"1⤵PID:1708
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1712
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1180
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\3.bin.exe"1⤵PID:1496
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1314537719-350317084-1424509936-14097726171475503760-1557436338396580378152271716"1⤵
- Suspicious use of SetWindowsHookEx
PID:1940
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN rwscnyojsy1⤵
- Uses Task Scheduler COM API
PID:1744
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "980062285196947700-1716757330334417404-1615426380-1262247379-1530377081-581022690"1⤵PID:1660
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:1552
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1060
- T1089