Analysis
-
max time kernel
84s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-11-2020 14:38
Static task
static1
General
-
Target
yshaln.exe
-
Size
1.0MB
-
MD5
335a6f75262d5db477a298db99518539
-
SHA1
d809eba3a437938c4258ad33727a9b5785bf7329
-
SHA256
19025bfe8d70970be34abe462a21ee7e40e64f5ba3b2a849783604aee166b8f0
-
SHA512
2050a7000a987dd48a02d3206bd8bfe41ba55a7edc306e37b197917f4ec3bd1de60da23e63f2d071cb3562bb84f4d7fc2a165ee06f432d45cec62717830b0d62
Malware Config
Extracted
qakbot
notset
1604404534
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
[email protected] - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
[email protected] - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
[email protected] - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
[email protected] - Password:
eQyicNLzzqPN
67.6.55.77:443
89.136.39.108:443
2.50.58.76:443
188.25.158.61:443
45.63.107.192:995
45.32.154.10:443
94.52.160.116:443
45.63.107.192:2222
45.63.107.192:443
72.204.242.138:465
84.117.176.32:443
95.77.223.148:443
47.146.39.147:443
41.225.13.128:8443
80.14.209.42:2222
190.220.8.10:995
66.76.105.194:443
105.101.69.242:443
89.33.87.107:443
75.136.40.155:443
78.97.3.6:443
108.46.145.30:443
68.134.181.98:443
85.121.42.12:995
75.87.161.32:995
68.174.15.223:443
149.28.99.97:995
199.247.16.80:443
45.32.155.12:443
149.28.99.97:2222
149.28.99.97:443
70.168.130.172:995
93.86.252.177:995
50.244.112.10:995
59.99.36.238:443
185.246.9.69:995
208.99.100.129:443
41.97.25.63:443
72.186.1.237:443
59.99.36.241:443
45.32.155.12:2222
96.30.198.161:443
140.82.27.132:443
45.32.165.134:443
45.63.104.123:443
207.246.70.216:443
97.118.38.31:993
134.228.24.29:443
188.25.24.21:2222
2.89.17.127:995
72.82.15.220:443
174.62.13.151:443
120.150.60.189:995
80.195.103.146:2222
142.129.227.86:443
89.137.221.232:443
98.26.50.62:995
74.129.26.119:443
146.199.132.233:2222
77.27.174.49:995
172.114.116.226:995
95.179.247.224:443
189.231.189.64:443
45.32.155.12:995
45.32.162.253:443
199.247.22.145:443
35.134.202.234:443
184.98.97.227:995
85.122.141.42:995
89.137.211.239:443
72.16.56.171:443
72.28.255.159:995
47.44.217.98:443
189.183.206.170:995
64.185.5.157:443
202.141.244.118:995
72.209.191.27:443
86.122.18.250:443
141.158.47.123:443
203.198.96.164:443
173.245.152.231:443
95.77.144.238:443
41.228.227.124:443
67.78.151.218:2222
84.232.238.30:443
188.27.32.167:443
173.3.17.223:995
201.215.96.174:0
69.11.247.242:443
87.65.204.240:995
207.246.75.201:443
217.162.149.212:443
45.77.193.83:443
80.240.26.178:443
98.16.204.189:995
173.90.33.182:2222
103.206.112.234:443
72.36.59.46:2222
190.220.8.10:443
86.98.89.245:2222
39.36.35.237:995
217.165.96.127:990
151.73.112.197:443
79.113.119.125:443
2.50.110.49:2078
72.66.47.70:443
93.113.177.152:443
103.238.231.35:443
78.97.207.104:443
156.213.227.208:443
71.163.223.253:443
108.31.15.10:995
184.21.136.237:443
184.179.14.130:22
81.133.234.36:2222
74.75.216.202:443
2.51.247.69:995
96.243.35.201:443
46.53.16.93:443
217.165.2.92:995
37.106.7.143:443
203.106.195.67:443
172.91.19.192:443
2.7.202.106:2222
78.96.199.79:443
184.55.32.182:443
24.205.42.241:443
103.76.160.110:443
188.121.219.88:2222
79.113.208.68:443
85.204.189.105:443
50.96.234.132:995
31.5.21.66:443
66.215.32.224:443
81.97.154.100:443
47.185.140.236:80
108.30.125.94:443
188.247.252.243:443
69.47.26.41:443
74.195.88.59:443
95.76.27.6:443
68.46.142.48:995
73.200.219.143:443
173.173.1.164:443
24.40.173.134:443
173.21.10.71:2222
73.225.67.0:443
45.47.65.191:443
75.106.52.142:443
75.182.220.196:2222
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
maniiiei.exemaniiiei.exepid process 3256 maniiiei.exe 1132 maniiiei.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
yshaln.exemaniiiei.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service yshaln.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc yshaln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 maniiiei.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc maniiiei.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service maniiiei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 maniiiei.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc maniiiei.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service maniiiei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 yshaln.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc yshaln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 yshaln.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service yshaln.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
yshaln.exeyshaln.exemaniiiei.exemaniiiei.exeexplorer.exeyshaln.exepid process 2208 yshaln.exe 2208 yshaln.exe 3472 yshaln.exe 3472 yshaln.exe 3472 yshaln.exe 3472 yshaln.exe 3256 maniiiei.exe 3256 maniiiei.exe 1132 maniiiei.exe 1132 maniiiei.exe 1132 maniiiei.exe 1132 maniiiei.exe 344 explorer.exe 344 explorer.exe 344 explorer.exe 344 explorer.exe 3728 yshaln.exe 3728 yshaln.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
maniiiei.exepid process 3256 maniiiei.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
yshaln.exemaniiiei.exedescription pid process target process PID 2208 wrote to memory of 3472 2208 yshaln.exe yshaln.exe PID 2208 wrote to memory of 3472 2208 yshaln.exe yshaln.exe PID 2208 wrote to memory of 3472 2208 yshaln.exe yshaln.exe PID 2208 wrote to memory of 3256 2208 yshaln.exe maniiiei.exe PID 2208 wrote to memory of 3256 2208 yshaln.exe maniiiei.exe PID 2208 wrote to memory of 3256 2208 yshaln.exe maniiiei.exe PID 2208 wrote to memory of 3576 2208 yshaln.exe schtasks.exe PID 2208 wrote to memory of 3576 2208 yshaln.exe schtasks.exe PID 2208 wrote to memory of 3576 2208 yshaln.exe schtasks.exe PID 3256 wrote to memory of 1132 3256 maniiiei.exe maniiiei.exe PID 3256 wrote to memory of 1132 3256 maniiiei.exe maniiiei.exe PID 3256 wrote to memory of 1132 3256 maniiiei.exe maniiiei.exe PID 3256 wrote to memory of 344 3256 maniiiei.exe explorer.exe PID 3256 wrote to memory of 344 3256 maniiiei.exe explorer.exe PID 3256 wrote to memory of 344 3256 maniiiei.exe explorer.exe PID 3256 wrote to memory of 344 3256 maniiiei.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yshaln.exe"C:\Users\Admin\AppData\Local\Temp\yshaln.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\yshaln.exeC:\Users\Admin\AppData\Local\Temp\yshaln.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3472 -
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exeC:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exeC:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1132 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:344 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xlleydm /tr "\"C:\Users\Admin\AppData\Local\Temp\yshaln.exe\" /I xlleydm" /SC ONCE /Z /ST 15:43 /ET 15:552⤵
- Creates scheduled task(s)
PID:3576
-
C:\Users\Admin\AppData\Local\Temp\yshaln.exeC:\Users\Admin\AppData\Local\Temp\yshaln.exe /I xlleydm1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.datMD5
70e68a8c393c506624c86a6d8ae52d00
SHA1a194a0162767a5a9f80e223ce66ea5d4f2324e13
SHA2560de69ea99ec12bc24cd75d7ac9827bd49e153e487202ab326bff86e03fbc659f
SHA512c429fa12dbcd62606006f0a446043eb864539ed2b372942e9d936d0fd990e7b7df2ba5d0fab5a9331d92ca4c4444c9d4eca22e55c0b668e84f265847f98b955b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exeMD5
335a6f75262d5db477a298db99518539
SHA1d809eba3a437938c4258ad33727a9b5785bf7329
SHA25619025bfe8d70970be34abe462a21ee7e40e64f5ba3b2a849783604aee166b8f0
SHA5122050a7000a987dd48a02d3206bd8bfe41ba55a7edc306e37b197917f4ec3bd1de60da23e63f2d071cb3562bb84f4d7fc2a165ee06f432d45cec62717830b0d62
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exeMD5
335a6f75262d5db477a298db99518539
SHA1d809eba3a437938c4258ad33727a9b5785bf7329
SHA25619025bfe8d70970be34abe462a21ee7e40e64f5ba3b2a849783604aee166b8f0
SHA5122050a7000a987dd48a02d3206bd8bfe41ba55a7edc306e37b197917f4ec3bd1de60da23e63f2d071cb3562bb84f4d7fc2a165ee06f432d45cec62717830b0d62
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aozujznolue\maniiiei.exeMD5
335a6f75262d5db477a298db99518539
SHA1d809eba3a437938c4258ad33727a9b5785bf7329
SHA25619025bfe8d70970be34abe462a21ee7e40e64f5ba3b2a849783604aee166b8f0
SHA5122050a7000a987dd48a02d3206bd8bfe41ba55a7edc306e37b197917f4ec3bd1de60da23e63f2d071cb3562bb84f4d7fc2a165ee06f432d45cec62717830b0d62
-
memory/344-10-0x0000000000000000-mapping.dmp
-
memory/1132-6-0x0000000000000000-mapping.dmp
-
memory/1132-8-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/3256-2-0x0000000000000000-mapping.dmp
-
memory/3256-9-0x0000000002080000-0x00000000020BA000-memory.dmpFilesize
232KB
-
memory/3472-0-0x0000000000000000-mapping.dmp
-
memory/3472-1-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/3576-5-0x0000000000000000-mapping.dmp