Overview
overview
10Static
static
005cdb3474...6d.exe
windows7_x64
10005cdb3474...6d.exe
windows10_x64
103f0879776f...c0.exe
windows7_x64
3f0879776f...c0.exe
windows10_x64
4568b57ad4...74.exe
windows7_x64
104568b57ad4...74.exe
windows10_x64
105aa990d786...ba.exe
windows7_x64
105aa990d786...ba.exe
windows10_x64
105d60ef2d7c...0b.exe
windows7_x64
105d60ef2d7c...0b.exe
windows10_x64
1083b15f14e1...8a.exe
windows7_x64
1083b15f14e1...8a.exe
windows10_x64
18edc802c27...79.exe
windows7_x64
108edc802c27...79.exe
windows10_x64
1ae95189f75...dc.exe
windows7_x64
10ae95189f75...dc.exe
windows10_x64
10d92312b6a9...f8.exe
windows7_x64
10d92312b6a9...f8.exe
windows10_x64
10e166035566...2c.exe
windows7_x64
10e166035566...2c.exe
windows10_x64
10Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 12:27
Static task
static1
Behavioral task
behavioral1
Sample
005cdb34748048c41a3c57ba7358986d.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
005cdb34748048c41a3c57ba7358986d.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
3f0879776f937dbb75e02826b39e09c0.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
3f0879776f937dbb75e02826b39e09c0.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
4568b57ad46502fe4740a6ec3282a874.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
4568b57ad46502fe4740a6ec3282a874.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
5aa990d7864b3bd6c80718c7e86e00ba.exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
5aa990d7864b3bd6c80718c7e86e00ba.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
5d60ef2d7cb084878cdcccd63b4df50b.exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
5d60ef2d7cb084878cdcccd63b4df50b.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
83b15f14e171cce96ab3fdea915c388a.exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
83b15f14e171cce96ab3fdea915c388a.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
8edc802c274f3fd64be9aa5557b7ca79.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
8edc802c274f3fd64be9aa5557b7ca79.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
ae95189f757df558e743ff2e0701f3dc.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
ae95189f757df558e743ff2e0701f3dc.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
d92312b6a956d0d1da70c007068965f8.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
d92312b6a956d0d1da70c007068965f8.exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
e166035566a91e406ce66656be68012c.exe
Resource
win7v20210410
General
-
Target
4568b57ad46502fe4740a6ec3282a874.exe
-
Size
491KB
-
MD5
4568b57ad46502fe4740a6ec3282a874
-
SHA1
bed4802d8f6ec52c5e6a9215d78e0632d2ac11a0
-
SHA256
b5a90a7357ddd95c88a6f042f9a5b9d388ce936df393987a565209a140046905
-
SHA512
c704d8f493c653e6573172a3763a1186a30092e0534a677583b6b901d1599ed181c8c199e4a9f1e59bb82296ce8c9fa273df39ec819ba6da0e45dba508942a47
Malware Config
Extracted
qakbot
324.142
domain01
1591171636
67.165.206.193:995
173.187.103.35:443
47.153.115.154:443
188.192.75.8:995
47.40.244.237:443
142.129.227.86:443
39.36.14.99:995
45.77.164.175:443
71.241.247.189:443
103.76.160.110:443
117.192.100.60:443
207.246.71.122:443
144.202.48.107:443
93.118.221.117:443
45.77.215.141:443
71.185.60.227:443
178.86.244.141:443
72.204.242.138:53
47.41.3.40:443
24.202.42.48:2222
74.75.216.202:443
98.16.204.189:995
50.78.93.74:443
71.213.29.14:995
67.246.16.250:995
85.186.50.42:443
117.216.184.131:443
172.78.30.215:443
35.142.12.163:2222
189.231.198.212:443
76.169.33.226:443
189.236.218.181:443
89.137.162.193:443
137.103.143.124:443
84.247.55.190:443
173.49.122.160:995
59.98.96.214:443
59.26.204.210:443
190.204.7.122:2078
188.26.243.186:443
96.56.237.174:32103
35.143.248.234:443
80.14.209.42:2222
41.232.233.231:995
71.88.104.107:995
86.233.4.153:2222
72.186.1.237:443
137.99.224.198:443
75.183.171.155:3389
216.201.162.158:995
41.129.128.231:443
93.114.121.184:443
70.183.127.6:995
24.122.228.88:443
72.36.59.46:2222
84.117.43.216:443
207.255.161.8:995
96.56.237.174:990
24.43.22.220:993
100.4.173.223:443
85.204.189.105:443
47.138.200.85:443
81.133.234.36:2222
108.58.9.238:443
85.121.42.12:995
109.163.170.31:443
197.165.230.115:443
84.117.60.157:443
41.227.80.133:443
75.110.250.89:443
73.226.220.56:443
207.255.161.8:443
104.235.61.64:443
108.185.113.12:443
94.10.81.239:443
81.196.76.56:443
178.223.27.143:995
79.119.67.149:443
73.137.187.150:443
89.137.101.104:443
65.100.247.6:2083
82.76.239.193:443
199.250.144.26:443
73.94.229.115:443
80.240.26.178:443
197.210.96.222:995
64.19.74.29:995
24.201.79.208:2078
98.115.138.61:443
75.87.161.32:995
68.174.15.223:443
50.244.112.10:443
173.22.120.11:2222
67.250.184.157:443
187.155.70.157:443
207.255.161.8:2078
72.204.242.138:443
98.32.60.217:443
50.29.181.193:995
207.255.161.8:32103
24.152.219.253:995
72.204.242.138:2078
173.187.170.190:443
24.110.96.149:443
24.43.22.220:443
207.255.161.8:2087
98.219.77.197:443
207.255.161.8:32102
66.222.88.126:995
24.226.137.154:443
108.58.9.238:995
47.152.210.233:443
1.40.42.4:443
82.127.193.151:2222
104.50.141.139:995
67.83.54.76:2222
67.131.59.17:443
72.29.181.77:2078
98.114.185.3:443
71.187.170.235:443
134.0.196.46:995
108.51.73.186:443
75.81.25.223:443
70.173.61.61:443
50.247.230.33:995
96.56.237.174:993
216.163.4.91:443
176.223.54.116:2222
98.4.227.199:443
24.43.22.220:995
76.170.77.99:443
36.77.151.211:443
24.10.42.174:443
69.92.54.95:995
108.31.92.113:443
47.205.231.60:443
66.26.160.37:443
65.131.83.170:995
72.132.249.144:995
71.163.225.75:443
71.77.231.251:443
50.244.112.106:443
105.100.18.200:443
47.153.115.154:995
72.16.212.108:465
24.46.40.189:2222
5.13.99.38:995
188.27.6.170:443
84.232.238.30:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
4568b57ad46502fe4740a6ec3282a874.exe4568b57ad46502fe4740a6ec3282a874.exepid process 1852 4568b57ad46502fe4740a6ec3282a874.exe 820 4568b57ad46502fe4740a6ec3282a874.exe 820 4568b57ad46502fe4740a6ec3282a874.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4568b57ad46502fe4740a6ec3282a874.execmd.exedescription pid process target process PID 1852 wrote to memory of 820 1852 4568b57ad46502fe4740a6ec3282a874.exe 4568b57ad46502fe4740a6ec3282a874.exe PID 1852 wrote to memory of 820 1852 4568b57ad46502fe4740a6ec3282a874.exe 4568b57ad46502fe4740a6ec3282a874.exe PID 1852 wrote to memory of 820 1852 4568b57ad46502fe4740a6ec3282a874.exe 4568b57ad46502fe4740a6ec3282a874.exe PID 1852 wrote to memory of 820 1852 4568b57ad46502fe4740a6ec3282a874.exe 4568b57ad46502fe4740a6ec3282a874.exe PID 1852 wrote to memory of 752 1852 4568b57ad46502fe4740a6ec3282a874.exe cmd.exe PID 1852 wrote to memory of 752 1852 4568b57ad46502fe4740a6ec3282a874.exe cmd.exe PID 1852 wrote to memory of 752 1852 4568b57ad46502fe4740a6ec3282a874.exe cmd.exe PID 1852 wrote to memory of 752 1852 4568b57ad46502fe4740a6ec3282a874.exe cmd.exe PID 752 wrote to memory of 1676 752 cmd.exe PING.EXE PID 752 wrote to memory of 1676 752 cmd.exe PING.EXE PID 752 wrote to memory of 1676 752 cmd.exe PING.EXE PID 752 wrote to memory of 1676 752 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4568b57ad46502fe4740a6ec3282a874.exe"C:\Users\Admin\AppData\Local\Temp\4568b57ad46502fe4740a6ec3282a874.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4568b57ad46502fe4740a6ec3282a874.exeC:\Users\Admin\AppData\Local\Temp\4568b57ad46502fe4740a6ec3282a874.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4568b57ad46502fe4740a6ec3282a874.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-67-0x0000000000000000-mapping.dmp
-
memory/820-63-0x0000000000000000-mapping.dmp
-
memory/820-66-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1676-68-0x0000000000000000-mapping.dmp
-
memory/1852-60-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/1852-61-0x00000000001B0000-0x00000000001E7000-memory.dmpFilesize
220KB
-
memory/1852-62-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB