Overview
overview
10Static
static
005cdb3474...6d.exe
windows7_x64
10005cdb3474...6d.exe
windows10_x64
103f0879776f...c0.exe
windows7_x64
3f0879776f...c0.exe
windows10_x64
4568b57ad4...74.exe
windows7_x64
104568b57ad4...74.exe
windows10_x64
105aa990d786...ba.exe
windows7_x64
105aa990d786...ba.exe
windows10_x64
105d60ef2d7c...0b.exe
windows7_x64
105d60ef2d7c...0b.exe
windows10_x64
1083b15f14e1...8a.exe
windows7_x64
1083b15f14e1...8a.exe
windows10_x64
18edc802c27...79.exe
windows7_x64
108edc802c27...79.exe
windows10_x64
1ae95189f75...dc.exe
windows7_x64
10ae95189f75...dc.exe
windows10_x64
10d92312b6a9...f8.exe
windows7_x64
10d92312b6a9...f8.exe
windows10_x64
10e166035566...2c.exe
windows7_x64
10e166035566...2c.exe
windows10_x64
10Analysis
-
max time kernel
133s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 12:27
Static task
static1
Behavioral task
behavioral1
Sample
005cdb34748048c41a3c57ba7358986d.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
005cdb34748048c41a3c57ba7358986d.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
3f0879776f937dbb75e02826b39e09c0.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
3f0879776f937dbb75e02826b39e09c0.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
4568b57ad46502fe4740a6ec3282a874.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
4568b57ad46502fe4740a6ec3282a874.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
5aa990d7864b3bd6c80718c7e86e00ba.exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
5aa990d7864b3bd6c80718c7e86e00ba.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
5d60ef2d7cb084878cdcccd63b4df50b.exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
5d60ef2d7cb084878cdcccd63b4df50b.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
83b15f14e171cce96ab3fdea915c388a.exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
83b15f14e171cce96ab3fdea915c388a.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
8edc802c274f3fd64be9aa5557b7ca79.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
8edc802c274f3fd64be9aa5557b7ca79.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
ae95189f757df558e743ff2e0701f3dc.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
ae95189f757df558e743ff2e0701f3dc.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
d92312b6a956d0d1da70c007068965f8.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
d92312b6a956d0d1da70c007068965f8.exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
e166035566a91e406ce66656be68012c.exe
Resource
win7v20210410
General
-
Target
5d60ef2d7cb084878cdcccd63b4df50b.exe
-
Size
4.1MB
-
MD5
5d60ef2d7cb084878cdcccd63b4df50b
-
SHA1
afff6fe7ebe180d393355ba9cd23a1f3a61efbc0
-
SHA256
daa9ddf216de176801e3a77b3f7a33691d92e2ab70e9f1c1aecebab6d21b1192
-
SHA512
232cec403902ffcc3078aedc65777adb8e6baea4dad099515ddd069bf1a7f479fcd9cf209dcd335a16d0e0a1e181e12e3c3462de3872a4011f93132ddac2f2eb
Malware Config
Extracted
qakbot
325.43
domain01
1602007616
77.27.174.49:995
68.14.210.246:22
208.93.202.49:443
50.244.112.106:443
173.44.112.112:443
184.98.103.204:995
72.204.242.138:20
96.18.240.158:443
93.149.253.201:2222
72.186.1.237:443
89.176.37.202:995
5.12.255.109:443
75.136.40.155:443
23.240.70.80:443
67.170.137.8:443
173.22.125.129:2222
71.80.66.107:443
189.222.203.96:443
96.243.35.201:443
201.103.0.150:443
197.210.96.222:995
69.123.179.70:443
89.137.211.239:443
68.116.193.239:443
84.117.176.32:443
203.198.96.200:443
84.232.131.0:443
173.90.33.182:2222
77.31.120.194:995
190.30.185.80:443
173.173.1.164:443
80.240.26.178:443
72.240.200.181:2222
24.43.22.220:993
151.205.102.42:443
69.11.247.242:443
71.163.222.203:443
172.87.134.226:443
65.131.72.17:995
109.93.11.111:995
67.6.55.77:443
173.70.165.101:995
77.30.32.191:995
108.46.145.30:443
207.255.161.8:993
199.247.22.145:443
45.32.155.12:443
74.73.27.35:443
96.227.127.13:443
199.116.241.147:443
95.77.144.238:443
71.187.170.235:443
190.147.186.58:443
71.126.139.251:443
172.78.30.215:443
74.75.237.11:443
71.182.142.63:443
184.21.136.237:443
190.85.91.154:443
86.123.228.81:443
187.200.206.46:443
71.56.53.127:443
5.15.24.112:443
68.46.142.48:995
92.81.159.233:443
24.205.42.241:443
190.220.8.10:443
24.53.49.240:2222
96.30.198.161:443
184.97.132.62:443
45.46.53.140:2222
71.74.12.34:443
207.246.75.201:443
75.137.239.211:443
155.186.9.160:443
45.77.193.83:443
93.113.177.152:443
74.109.219.145:443
73.23.194.75:443
108.190.151.108:2222
72.204.242.138:990
98.240.24.57:443
65.30.213.13:6882
208.99.100.129:443
72.204.242.138:32102
72.204.242.138:443
47.44.217.98:443
24.229.150.54:995
217.162.149.212:443
24.71.28.247:443
108.5.34.248:443
2.89.114.20:443
70.168.130.172:995
103.238.231.40:443
73.228.1.246:443
72.29.181.78:2222
207.255.161.8:995
45.32.154.10:443
96.247.181.229:443
24.122.0.90:443
184.180.157.203:2222
72.204.242.138:53
98.26.50.62:995
67.60.113.253:2222
72.50.70.14:443
66.215.32.224:443
197.37.227.250:993
134.228.24.29:443
75.82.182.228:2222
72.204.242.138:32100
100.43.250.74:995
72.190.101.70:443
217.165.96.127:990
207.255.18.67:443
71.19.217.23:443
72.204.242.138:50001
199.247.16.80:443
66.31.150.18:443
95.179.247.224:443
2.50.57.36:443
141.158.47.123:443
80.195.103.146:2222
2.51.221.138:995
146.200.250.36:2222
66.26.160.37:443
24.234.86.201:995
108.30.125.94:443
207.255.161.8:443
100.4.173.223:443
186.31.47.126:443
86.177.171.45:2222
70.124.29.226:443
47.18.252.216:2222
216.201.162.158:443
71.184.116.20:443
205.178.7.90:443
86.121.121.14:2222
31.215.193.110:443
67.165.206.193:993
71.197.126.250:443
2.50.131.64:443
5.15.119.56:443
66.222.88.126:995
192.100.72.2:2222
79.113.250.136:443
35.134.202.234:443
74.105.52.200:443
188.247.252.243:443
90.175.88.99:2222
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5d60ef2d7cb084878cdcccd63b4df50b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtzzxsi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Cxyquk\\oflvikl.exe\"" 5d60ef2d7cb084878cdcccd63b4df50b.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5d60ef2d7cb084878cdcccd63b4df50b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 5d60ef2d7cb084878cdcccd63b4df50b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 5d60ef2d7cb084878cdcccd63b4df50b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 5d60ef2d7cb084878cdcccd63b4df50b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 5d60ef2d7cb084878cdcccd63b4df50b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 5d60ef2d7cb084878cdcccd63b4df50b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 5d60ef2d7cb084878cdcccd63b4df50b.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5d60ef2d7cb084878cdcccd63b4df50b.exe5d60ef2d7cb084878cdcccd63b4df50b.exepid process 416 5d60ef2d7cb084878cdcccd63b4df50b.exe 416 5d60ef2d7cb084878cdcccd63b4df50b.exe 1296 5d60ef2d7cb084878cdcccd63b4df50b.exe 1296 5d60ef2d7cb084878cdcccd63b4df50b.exe 1296 5d60ef2d7cb084878cdcccd63b4df50b.exe 1296 5d60ef2d7cb084878cdcccd63b4df50b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5d60ef2d7cb084878cdcccd63b4df50b.exedescription pid process target process PID 416 wrote to memory of 1296 416 5d60ef2d7cb084878cdcccd63b4df50b.exe 5d60ef2d7cb084878cdcccd63b4df50b.exe PID 416 wrote to memory of 1296 416 5d60ef2d7cb084878cdcccd63b4df50b.exe 5d60ef2d7cb084878cdcccd63b4df50b.exe PID 416 wrote to memory of 1296 416 5d60ef2d7cb084878cdcccd63b4df50b.exe 5d60ef2d7cb084878cdcccd63b4df50b.exe PID 416 wrote to memory of 4036 416 5d60ef2d7cb084878cdcccd63b4df50b.exe schtasks.exe PID 416 wrote to memory of 4036 416 5d60ef2d7cb084878cdcccd63b4df50b.exe schtasks.exe PID 416 wrote to memory of 4036 416 5d60ef2d7cb084878cdcccd63b4df50b.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exe"C:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exeC:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xljuvbmivq /tr "\"C:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exe\" /I xljuvbmivq" /SC ONCE /Z /ST 12:33 /ET 12:452⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exeC:\Users\Admin\AppData\Local\Temp\5d60ef2d7cb084878cdcccd63b4df50b.exe /I xljuvbmivq1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/416-114-0x0000000000940000-0x0000000000A8A000-memory.dmpFilesize
1.3MB
-
memory/416-115-0x0000000000400000-0x0000000000819000-memory.dmpFilesize
4.1MB
-
memory/1296-116-0x0000000000000000-mapping.dmp
-
memory/1296-118-0x0000000000400000-0x0000000000819000-memory.dmpFilesize
4.1MB
-
memory/1296-117-0x0000000002450000-0x00000000024CC000-memory.dmpFilesize
496KB
-
memory/4036-119-0x0000000000000000-mapping.dmp