Analysis
- max time kernel
151s - max time network
9s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
dasfdsfsdf (1).exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target dasfdsfsdf (1).exe
- Size 1.0MB
- Sample201109-anda4zrhtj
- SHA256 053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061
- MD5 a7c930732560445a040bf5534d87013e
- SHA1 585d7cbb0dd5ae9a166f94949d2ac815b02fbc88
- SHA512 d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
qakbot
Botnet
-
spx139
Campaign
-
1591962820
C2
-
98.16.204.189:995
-
88.158.199.95:443
-
24.102.235.160:995
-
96.18.240.158:443
-
67.165.206.193:995
-
81.103.144.77:443
-
184.180.157.203:2222
-
47.136.224.60:443
-
104.221.4.11:2222
-
203.33.138.230:443
-
72.204.242.138:20
-
75.137.239.211:443
-
74.215.201.122:443
-
41.228.201.162:443
-
92.29.5.162:995
-
108.30.125.94:443
-
207.255.161.8:2078
-
173.172.205.216:443
-
68.134.181.98:443
-
5.12.50.241:443
-
41.129.128.231:443
-
89.247.216.59:443
-
59.95.84.255:443
-
24.229.245.124:995
-
98.114.185.3:443
-
207.255.18.67:443
-
108.49.221.180:443
-
86.125.140.0:2222
-
86.127.24.61:21
-
216.229.92.42:443
-
24.228.7.174:443
-
144.202.48.107:443
-
207.246.71.122:443
-
45.77.215.141:443
-
108.28.90.129:443
-
75.182.220.196:2222
-
86.233.4.153:2222
-
111.251.66.160:443
-
5.12.111.88:443
-
151.73.124.242:443
-
82.77.169.118:2222
-
81.133.234.36:2222
-
117.199.6.72:443
-
35.143.248.234:443
-
201.209.4.83:2078
-
82.37.242.8:443
-
84.232.238.30:443
-
24.164.79.147:443
-
80.14.209.42:2222
-
100.38.123.22:443
-
66.68.22.151:443
-
46.214.86.217:443
-
77.237.184.66:995
-
5.107.232.32:2222
-
70.168.130.172:443
-
96.56.237.174:990
-
79.116.229.37:443
-
118.168.236.225:443
-
79.115.254.172:443
-
86.4.44.48:443
-
24.27.82.216:2222
-
69.40.17.142:443
-
95.77.144.238:443
-
104.235.90.116:443
-
68.200.23.189:443
-
72.204.242.138:53
-
85.121.42.12:995
-
72.29.181.77:2078
-
24.122.228.88:443
-
216.229.92.42:995
-
67.83.54.76:2222
-
24.122.157.93:443
-
72.190.101.70:443
-
74.134.46.7:443
-
71.187.170.235:443
-
85.186.50.42:443
-
68.46.142.48:443
-
24.43.22.220:993
-
74.75.216.202:443
-
100.4.173.223:443
-
75.81.25.223:443
-
74.135.37.79:443
-
1.40.42.4:443
-
66.208.105.6:443
-
173.175.29.210:443
-
89.35.93.254:2222
-
81.245.66.237:995
-
199.247.16.80:443
-
80.240.26.178:443
-
199.247.22.145:443
-
216.201.162.158:995
-
178.223.17.74:995
-
72.240.245.253:443
-
70.174.3.241:443
-
47.203.42.163:443
-
72.204.242.138:50003
-
50.244.112.10:443
-
24.43.22.220:995
-
72.204.242.138:80
-
72.204.242.138:443
-
2.190.200.253:443
-
69.11.247.242:443
-
76.187.8.160:443
-
184.98.104.7:995
-
66.26.160.37:443
-
188.192.75.8:443
-
134.0.196.46:995
-
72.204.242.138:32100
-
65.131.83.170:995
-
75.183.135.48:443
-
72.16.212.108:465
-
77.159.149.74:443
-
200.113.201.83:993
-
72.204.242.138:6881
-
76.170.77.99:443
-
47.153.115.154:995
-
185.246.9.69:995
-
67.250.184.157:443
-
47.146.169.85:443
-
96.37.137.42:443
-
67.209.195.198:3389
-
74.56.167.31:443
-
68.4.137.211:443
-
189.236.218.181:443
-
47.41.3.40:443
-
207.255.161.8:443
-
73.214.248.17:995
-
96.56.237.174:993
-
100.40.48.96:443
-
79.113.215.51:443
-
98.118.156.172:443
-
70.183.127.6:995
-
50.104.68.223:443
-
24.201.79.208:2078
-
184.90.139.176:2222
-
24.202.42.48:2222
-
172.242.156.50:995
-
108.54.205.207:443
-
24.42.14.241:995
-
42.3.8.102:443
-
188.27.6.170:443
-
74.193.197.246:443
-
68.174.15.223:443
-
184.96.155.4:993
-
98.115.138.61:443
-
75.87.161.32:995
-
207.162.184.228:443
-
137.99.224.198:443
-
178.27.203.107:443
Signatures
- Turns off Windows Defender SpyNet reporting 2 TTPs
-
resource yara_rule behavioral1/files/0x0005000000013156-2.dat cryptone behavioral1/files/0x0005000000013156-3.dat cryptone behavioral1/files/0x0005000000013156-5.dat cryptone behavioral1/files/0x0005000000013156-7.dat cryptone behavioral1/files/0x0005000000013156-9.dat cryptone behavioral1/files/0x0005000000013156-24.dat cryptone behavioral1/files/0x0005000000013156-26.dat cryptone behavioral1/files/0x0005000000013156-31.dat cryptone - Executes dropped EXE 4 IoCs
pid Process 1708 oaoieix.exe 1524 oaoieix.exe 2036 oaoieix.exe 2024 oaoieix.exe - Loads dropped DLL 3 IoCs
pid Process 1668 dasfdsfsdf (1).exe 1668 dasfdsfsdf (1).exe 1584 dasfdsfsdf (1).exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1440 schtasks.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dasfdsfsdf (1).exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" dasfdsfsdf (1).exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" dasfdsfsdf (1).exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1736 PING.EXE - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1668 dasfdsfsdf (1).exe 1748 dasfdsfsdf (1).exe 1748 dasfdsfsdf (1).exe 1708 oaoieix.exe 1524 oaoieix.exe 1524 oaoieix.exe 1684 explorer.exe 1684 explorer.exe 1584 dasfdsfsdf (1).exe 2036 oaoieix.exe 2024 oaoieix.exe 2024 oaoieix.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1708 oaoieix.exe - Suspicious use of WriteProcessMemory 80 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1748 1668 dasfdsfsdf (1).exe 29 PID 1668 wrote to memory of 1748 1668 dasfdsfsdf (1).exe 29 PID 1668 wrote to memory of 1748 1668 dasfdsfsdf (1).exe 29 PID 1668 wrote to memory of 1748 1668 dasfdsfsdf (1).exe 29 PID 1668 wrote to memory of 1708 1668 dasfdsfsdf (1).exe 30 PID 1668 wrote to memory of 1708 1668 dasfdsfsdf (1).exe 30 PID 1668 wrote to memory of 1708 1668 dasfdsfsdf (1).exe 30 PID 1668 wrote to memory of 1708 1668 dasfdsfsdf (1).exe 30 PID 1668 wrote to memory of 1440 1668 dasfdsfsdf (1).exe 31 PID 1668 wrote to memory of 1440 1668 dasfdsfsdf (1).exe 31 PID 1668 wrote to memory of 1440 1668 dasfdsfsdf (1).exe 31 PID 1668 wrote to memory of 1440 1668 dasfdsfsdf (1).exe 31 PID 1708 wrote to memory of 1524 1708 oaoieix.exe 33 PID 1708 wrote to memory of 1524 1708 oaoieix.exe 33 PID 1708 wrote to memory of 1524 1708 oaoieix.exe 33 PID 1708 wrote to memory of 1524 1708 oaoieix.exe 33 PID 1708 wrote to memory of 1684 1708 oaoieix.exe 34 PID 1708 wrote to memory of 1684 1708 oaoieix.exe 34 PID 1708 wrote to memory of 1684 1708 oaoieix.exe 34 PID 1708 wrote to memory of 1684 1708 oaoieix.exe 34 PID 1708 wrote to memory of 1684 1708 oaoieix.exe 34 PID 272 wrote to memory of 1584 272 taskeng.exe 36 PID 272 wrote to memory of 1584 272 taskeng.exe 36 PID 272 wrote to memory of 1584 272 taskeng.exe 36 PID 272 wrote to memory of 1584 272 taskeng.exe 36 PID 1584 wrote to memory of 1232 1584 dasfdsfsdf (1).exe 37 PID 1584 wrote to memory of 1232 1584 dasfdsfsdf (1).exe 37 PID 1584 wrote to memory of 1232 1584 dasfdsfsdf (1).exe 37 PID 1584 wrote to memory of 1232 1584 dasfdsfsdf (1).exe 37 PID 1584 wrote to memory of 1000 1584 dasfdsfsdf (1).exe 39 PID 1584 wrote to memory of 1000 1584 dasfdsfsdf (1).exe 39 PID 1584 wrote to memory of 1000 1584 dasfdsfsdf (1).exe 39 PID 1584 wrote to memory of 1000 1584 dasfdsfsdf (1).exe 39 PID 1584 wrote to memory of 984 1584 dasfdsfsdf (1).exe 41 PID 1584 wrote to memory of 984 1584 dasfdsfsdf (1).exe 41 PID 1584 wrote to memory of 984 1584 dasfdsfsdf (1).exe 41 PID 1584 wrote to memory of 984 1584 dasfdsfsdf (1).exe 41 PID 1584 wrote to memory of 892 1584 dasfdsfsdf (1).exe 43 PID 1584 wrote to memory of 892 1584 dasfdsfsdf (1).exe 43 PID 1584 wrote to memory of 892 1584 dasfdsfsdf (1).exe 43 PID 1584 wrote to memory of 892 1584 dasfdsfsdf (1).exe 43 PID 1584 wrote to memory of 1904 1584 dasfdsfsdf (1).exe 45 PID 1584 wrote to memory of 1904 1584 dasfdsfsdf (1).exe 45 PID 1584 wrote to memory of 1904 1584 dasfdsfsdf (1).exe 45 PID 1584 wrote to memory of 1904 1584 dasfdsfsdf (1).exe 45 PID 1584 wrote to memory of 1084 1584 dasfdsfsdf (1).exe 47 PID 1584 wrote to memory of 1084 1584 dasfdsfsdf (1).exe 47 PID 1584 wrote to memory of 1084 1584 dasfdsfsdf (1).exe 47 PID 1584 wrote to memory of 1084 1584 dasfdsfsdf (1).exe 47 PID 1584 wrote to memory of 972 1584 dasfdsfsdf (1).exe 49 PID 1584 wrote to memory of 972 1584 dasfdsfsdf (1).exe 49 PID 1584 wrote to memory of 972 1584 dasfdsfsdf (1).exe 49 PID 1584 wrote to memory of 972 1584 dasfdsfsdf (1).exe 49 PID 1584 wrote to memory of 932 1584 dasfdsfsdf (1).exe 51 PID 1584 wrote to memory of 932 1584 dasfdsfsdf (1).exe 51 PID 1584 wrote to memory of 932 1584 dasfdsfsdf (1).exe 51 PID 1584 wrote to memory of 932 1584 dasfdsfsdf (1).exe 51 PID 1584 wrote to memory of 1580 1584 dasfdsfsdf (1).exe 53 PID 1584 wrote to memory of 1580 1584 dasfdsfsdf (1).exe 53 PID 1584 wrote to memory of 1580 1584 dasfdsfsdf (1).exe 53 PID 1584 wrote to memory of 1580 1584 dasfdsfsdf (1).exe 53 PID 1584 wrote to memory of 2036 1584 dasfdsfsdf (1).exe 55 PID 1584 wrote to memory of 2036 1584 dasfdsfsdf (1).exe 55 PID 1584 wrote to memory of 2036 1584 dasfdsfsdf (1).exe 55 PID 1584 wrote to memory of 2036 1584 dasfdsfsdf (1).exe 55 PID 1584 wrote to memory of 1796 1584 dasfdsfsdf (1).exe 56 PID 1584 wrote to memory of 1796 1584 dasfdsfsdf (1).exe 56 PID 1584 wrote to memory of 1796 1584 dasfdsfsdf (1).exe 56 PID 1584 wrote to memory of 1796 1584 dasfdsfsdf (1).exe 56 PID 1584 wrote to memory of 1472 1584 dasfdsfsdf (1).exe 57 PID 1584 wrote to memory of 1472 1584 dasfdsfsdf (1).exe 57 PID 1584 wrote to memory of 1472 1584 dasfdsfsdf (1).exe 57 PID 1584 wrote to memory of 1472 1584 dasfdsfsdf (1).exe 57 PID 1796 wrote to memory of 1736 1796 cmd.exe 60 PID 1796 wrote to memory of 1736 1796 cmd.exe 60 PID 1796 wrote to memory of 1736 1796 cmd.exe 60 PID 2036 wrote to memory of 2024 2036 oaoieix.exe 61 PID 2036 wrote to memory of 2024 2036 oaoieix.exe 61 PID 2036 wrote to memory of 2024 2036 oaoieix.exe 61 PID 2036 wrote to memory of 2024 2036 oaoieix.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /C2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exeC:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exeC:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1524
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gxkaticntx /tr "\"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe\" /I gxkaticntx" /SC ONCE /Z /ST 04:29 /ET 04:412⤵
- Creates scheduled task(s)
PID:1440
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C7E3AC36-9012-4C15-966F-740D7C4E789C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /I gxkaticntx2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵PID:1232
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵PID:1000
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵PID:984
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵PID:892
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵PID:1904
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵PID:1084
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵PID:972
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵PID:932
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Stneii" /d "0"3⤵PID:1580
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exeC:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exeC:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe /C4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"3⤵PID:1796
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
PID:1736
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN gxkaticntx3⤵PID:1472
-
-