Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 23:03
Behavioral task
behavioral1
Sample
ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe
Resource
win7v20210408
General
-
Target
ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe
-
Size
1.8MB
-
MD5
3d09a98672e56f36612e4dc2f194bcb0
-
SHA1
15c1bec6d31637d942b918297401d40f12572b7b
-
SHA256
ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408
-
SHA512
e9357e9878aa91839540b7e11121d92f839ab4c256cb9107da8db468a412e7e048a057933ea139ee68dc37f193aef731a7c55cb0ad0998a630c890e78a33723e
Malware Config
Extracted
qakbot
324.136
spx111
1588597375
98.22.234.245:443
188.173.70.18:443
189.159.19.223:995
73.60.148.209:443
74.105.139.160:443
50.244.112.106:443
47.232.26.181:443
50.104.186.71:443
173.172.205.216:443
208.126.142.17:443
71.197.31.92:0
72.240.65.85:443
24.183.39.93:443
73.137.187.150:443
74.135.85.117:443
172.87.134.226:443
201.146.188.44:443
76.170.77.99:443
67.170.137.8:443
24.55.152.50:995
72.204.242.138:2087
72.204.242.138:80
24.184.5.251:2222
178.193.33.121:2222
98.219.77.197:443
1.40.42.4:443
71.80.66.107:443
108.27.217.44:443
72.204.242.138:53
97.78.107.14:443
70.170.111.174:443
98.16.204.189:995
47.41.3.40:443
184.57.17.74:443
58.108.188.231:443
47.136.224.60:443
72.29.181.77:2078
79.116.54.222:443
202.77.4.37:443
176.223.41.186:443
79.114.189.227:443
24.201.79.208:2078
92.253.27.216:443
75.90.212.209:995
45.46.175.21:443
67.6.34.43:443
5.182.39.156:443
68.206.128.206:2222
96.41.93.96:443
187.163.101.137:995
68.60.221.169:465
64.250.173.8:443
50.89.14.94:443
95.77.204.208:443
81.102.127.116:443
73.210.114.187:443
206.183.190.53:995
81.133.234.36:2222
68.46.225.201:443
68.204.164.222:443
208.93.202.49:443
98.116.62.242:443
72.204.242.138:32102
78.96.193.12:443
98.199.150.30:443
63.230.2.205:2083
184.167.2.251:2222
72.185.47.86:995
207.255.158.180:443
35.143.205.199:443
173.173.68.41:443
75.183.171.155:3389
5.193.175.12:2078
72.204.242.138:6881
184.98.104.7:995
78.96.148.177:443
47.146.169.85:443
47.214.144.253:443
94.52.124.226:443
74.134.4.236:443
79.118.178.20:443
67.131.59.17:443
41.97.168.5:443
108.190.151.108:2222
75.142.59.167:443
47.40.244.237:443
173.216.174.39:443
67.141.143.110:443
85.204.189.105:443
188.25.26.84:443
24.228.7.174:443
98.121.187.78:443
72.183.129.56:443
217.162.149.212:443
72.142.106.198:995
68.82.125.234:443
104.36.135.227:443
86.22.41.176:443
108.30.125.94:443
86.126.195.16:443
5.15.29.145:443
96.232.203.15:443
46.214.86.217:443
73.244.83.199:443
84.117.176.32:443
71.241.247.189:443
75.183.135.48:443
98.199.226.41:443
73.23.194.75:443
188.25.237.208:443
73.209.113.58:443
65.60.228.130:443
86.122.237.110:2222
66.208.105.6:443
84.117.60.157:443
79.119.244.255:443
39.50.188.201:995
71.77.231.251:443
173.3.132.17:995
75.81.25.223:995
100.38.123.22:443
75.109.223.243:443
79.117.217.74:21
47.153.115.154:443
67.165.206.193:995
98.118.156.172:443
74.75.237.11:443
41.233.43.51:995
100.40.48.96:443
110.142.205.182:443
216.152.7.12:443
108.54.103.234:443
71.163.225.75:443
64.19.74.29:995
68.174.15.223:443
73.94.229.115:443
151.224.19.189:443
47.17.70.45:443
96.35.170.82:2222
31.5.189.71:443
68.1.171.93:443
134.19.208.152:443
63.155.71.107:995
68.39.177.147:995
68.49.120.179:443
172.95.42.35:443
72.204.242.138:993
188.25.230.80:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exeed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exepid process 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe 1772 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe 1772 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.execmd.exedescription pid process target process PID 1820 wrote to memory of 1772 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe PID 1820 wrote to memory of 1772 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe PID 1820 wrote to memory of 1772 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe PID 1820 wrote to memory of 1772 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe PID 1820 wrote to memory of 1688 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe cmd.exe PID 1820 wrote to memory of 1688 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe cmd.exe PID 1820 wrote to memory of 1688 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe cmd.exe PID 1820 wrote to memory of 1688 1820 ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe cmd.exe PID 1688 wrote to memory of 668 1688 cmd.exe PING.EXE PID 1688 wrote to memory of 668 1688 cmd.exe PING.EXE PID 1688 wrote to memory of 668 1688 cmd.exe PING.EXE PID 1688 wrote to memory of 668 1688 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe"C:\Users\Admin\AppData\Local\Temp\ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exeC:\Users\Admin\AppData\Local\Temp\ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ed6f351048622be44ab4b5b4db2d3d9de71a34c62262cba28c3ae4fe1746f408.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-68-0x0000000000000000-mapping.dmp
-
memory/1688-67-0x0000000000000000-mapping.dmp
-
memory/1772-63-0x0000000000000000-mapping.dmp
-
memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1820-61-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB
-
memory/1820-62-0x0000000000400000-0x00000000005CA000-memory.dmpFilesize
1.8MB