Analysis
-
max time kernel
93s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-05-2021 10:08
Static task
static1
Behavioral task
behavioral1
Sample
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe
Resource
win7v20210408
General
-
Target
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe
-
Size
4.3MB
-
MD5
5ed9fb5fc74c6fdb3537629e9b23437a
-
SHA1
67424175620be87fd3b2810ba5eba0d9e0bee49f
-
SHA256
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869
-
SHA512
5361a9e0698380c0dbd510e906ac63fb11e69a3ec0e6548304db288a1b20c3016b1223587f573dfb2468e005e71af0b3b942265b38f8b0454163792b3766fd2f
Malware Config
Extracted
qakbot
325.43
domain01
1597161528
96.227.127.13:443
197.37.252.37:993
95.221.48.169:2222
72.190.101.70:443
47.39.76.74:443
207.255.18.67:443
108.46.145.30:443
142.117.109.129:2222
176.205.255.97:443
2.89.74.34:995
98.219.77.197:443
75.110.250.89:995
47.28.131.209:443
47.18.252.135:2222
66.30.92.147:443
188.51.3.210:995
83.110.92.29:443
68.225.56.31:443
189.183.72.138:995
98.121.187.78:443
93.113.177.152:443
108.30.125.94:443
5.193.178.241:2078
24.139.132.70:443
24.71.28.247:443
151.73.127.65:443
193.248.44.2:2222
2.89.74.34:21
79.118.187.79:443
85.186.233.237:443
66.222.88.126:995
197.210.96.222:995
95.76.109.181:443
208.93.202.49:443
98.110.231.63:443
76.111.128.194:443
71.192.44.92:443
207.255.161.8:993
47.153.115.154:995
172.78.30.215:443
200.124.231.21:443
47.146.32.175:443
12.5.37.3:995
144.139.47.206:443
165.228.200.94:443
216.201.162.158:443
24.46.40.189:2222
50.244.112.10:995
95.77.144.238:443
41.228.218.242:443
109.154.214.242:2222
24.201.79.208:2078
41.36.55.195:995
78.100.229.44:61201
96.20.108.17:2222
68.174.15.223:443
173.173.72.199:443
115.21.224.117:443
70.95.118.217:443
24.116.227.63:443
70.164.39.91:443
24.234.86.201:995
201.216.216.245:443
5.15.65.198:2222
24.122.228.88:443
186.82.157.66:443
99.240.226.2:443
100.4.173.223:443
95.77.223.148:443
185.19.190.81:443
67.170.137.8:443
134.0.196.46:995
71.163.224.206:443
24.37.178.158:443
65.96.36.157:443
81.133.234.36:2222
73.60.148.209:443
187.200.218.244:443
178.222.12.162:995
89.47.110.5:443
189.231.196.216:443
103.238.231.40:443
69.123.179.70:443
35.134.202.234:443
35.209.218.146:443
174.80.7.235:443
45.32.155.12:443
174.82.131.155:995
86.127.149.136:443
189.130.26.216:443
189.223.67.205:443
45.32.154.10:443
66.26.160.37:443
104.235.94.155:443
2.89.74.34:20
71.220.191.200:443
72.142.106.198:995
2.51.240.61:995
73.227.232.166:443
72.28.255.159:995
141.158.47.123:443
172.87.134.226:443
24.204.155.208:443
39.118.245.6:443
71.187.170.235:443
188.15.173.34:995
72.240.200.181:2222
166.62.180.194:2078
98.243.187.85:443
50.244.112.106:443
189.140.55.226:443
188.26.11.29:2222
210.195.174.114:443
200.84.244.33:2078
185.246.9.69:995
209.59.86.206:20
206.51.202.106:50003
5.12.114.55:443
68.116.193.239:443
173.26.189.151:443
102.190.213.116:443
78.100.192.173:443
209.182.122.217:443
68.134.181.98:443
5.13.73.44:443
189.210.114.157:443
179.14.167.91:443
89.137.215.100:443
149.71.49.39:443
85.122.141.42:995
100.37.36.240:443
77.27.173.8:995
75.137.239.211:443
213.120.109.73:2222
76.170.77.99:995
98.173.34.212:995
73.140.88.255:443
73.228.1.246:443
96.234.20.230:443
70.126.76.75:443
70.123.92.175:2222
92.59.35.196:2222
99.231.221.117:443
151.205.102.42:443
5.13.102.138:995
71.182.142.63:443
81.103.144.77:443
47.44.217.98:443
134.228.24.29:443
73.137.184.213:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exefec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exepid process 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe 3828 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe 3828 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe 3828 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe 3828 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.execmd.exedescription pid process target process PID 4656 wrote to memory of 3828 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe PID 4656 wrote to memory of 3828 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe PID 4656 wrote to memory of 3828 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe PID 4656 wrote to memory of 4084 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe cmd.exe PID 4656 wrote to memory of 4084 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe cmd.exe PID 4656 wrote to memory of 4084 4656 fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe cmd.exe PID 4084 wrote to memory of 4176 4084 cmd.exe PING.EXE PID 4084 wrote to memory of 4176 4084 cmd.exe PING.EXE PID 4084 wrote to memory of 4176 4084 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe"C:\Users\Admin\AppData\Local\Temp\fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exeC:\Users\Admin\AppData\Local\Temp\fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\fec51f04710e3aae47dd23b084d8a364fa07c25dda5b229aeb3e6a98c56fa869.dll.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3828-116-0x0000000000000000-mapping.dmp
-
memory/3828-120-0x0000000000400000-0x0000000000852000-memory.dmpFilesize
4.3MB
-
memory/4084-117-0x0000000000000000-mapping.dmp
-
memory/4176-118-0x0000000000000000-mapping.dmp
-
memory/4656-115-0x0000000000400000-0x0000000000852000-memory.dmpFilesize
4.3MB
-
memory/4656-114-0x00000000025A0000-0x000000000261C000-memory.dmpFilesize
496KB