http://lindentowncenter.com/xnvejyacq/2767/Darlehensvertrag_2767_18052020.zip

General
Target

http://lindentowncenter.com/xnvejyacq/2767/Darlehensvertrag_2767_18052020.zip

Filesize

N/A

Completed

19-05-2020 20:20

Score
10 /10
MD5

N/A

SHA1

N/A

SHA256

N/A

Malware Config

Extracted

Family qakbot
Botnet spx122
C2

72.183.129.56:443

72.190.101.70:443

74.75.216.202:443

47.40.244.237:443

209.182.121.133:2222

85.121.42.12:995

203.213.104.25:995

98.118.156.172:443

74.215.201.122:443

67.250.184.157:443

79.78.131.124:443

108.54.205.207:443

72.224.213.98:2222

24.27.82.216:2222

188.26.156.131:443

41.228.239.54:443

5.36.67.194:443

101.108.119.168:443

5.13.141.223:443

105.101.126.6:443

75.183.171.155:3389

46.102.61.96:2222

71.241.247.189:443

89.137.192.95:995

86.126.195.74:443

84.232.238.30:443

78.188.109.130:443

188.173.70.18:443

81.103.144.77:443

46.102.1.132:443

134.0.196.46:995

70.174.3.241:443

86.121.95.169:2222

31.5.116.167:443

31.5.189.71:443

201.209.46.211:2078

64.33.106.245:32101

182.56.134.44:995

96.10.113.218:995

47.138.200.85:443

173.245.152.231:443

71.213.29.14:995

49.191.9.180:995

70.57.15.187:993

50.247.230.33:995

76.170.77.99:443

124.134.41.246:995

97.127.144.203:2222

72.204.242.138:50003

46.214.139.81:443

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\WScript.exe.log

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4FFTI156\Darlehensvertrag_2767_18052020.zip.3c8cezq.partial

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\G7BCGXMW.cookie

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.dat

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Woyyenob\deveaoo.exe

    • memory/1268-30-0x0000000002830000-0x0000000002831000-memory.dmp

    • memory/1348-38-0x00000000028A0000-0x00000000028A1000-memory.dmp

    • memory/2052-41-0x0000000002780000-0x0000000002781000-memory.dmp

    • memory/2636-43-0x0000000002860000-0x0000000002861000-memory.dmp

    • memory/3068-20-0x00000000026D0000-0x00000000026D1000-memory.dmp

    • memory/3076-3-0x00000216ED0E0000-0x00000216ED0E4000-memory.dmp

    • memory/3508-31-0x0000000002170000-0x00000000021AA000-memory.dmp

    • memory/3760-33-0x0000000002730000-0x0000000002731000-memory.dmp