Analysis
-
max time kernel
29s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-07-2021 11:25
Behavioral task
behavioral1
Sample
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe
Resource
win7v20210410
General
-
Target
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe
-
Size
2.6MB
-
MD5
1f498b538c41c22731cde9f41cf92b32
-
SHA1
10c78eba96fd5be058bd179f464e88e1478e6d44
-
SHA256
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e
-
SHA512
2e21d3fdbdc95fb98f90d4f0c9116e3924e70a3a78f32dbd920c60e857feba68ec4d62c17e9b16cdd8cbb245a462c95523c01de270031c504d31f9cd5c91228d
Malware Config
Extracted
qakbot
324.142
spx144
1592561858
50.247.230.33:995
75.81.25.223:443
24.71.28.247:443
47.28.135.155:443
122.147.204.4:995
189.140.137.184:990
41.228.59.231:443
39.36.254.179:995
178.221.64.104:995
75.110.250.89:443
185.246.9.69:995
94.52.160.116:443
65.24.76.114:443
86.153.98.66:2222
117.218.208.239:443
98.118.156.172:443
72.179.242.236:0
108.46.145.30:443
68.200.23.189:443
84.232.238.30:443
148.75.231.53:443
173.49.122.160:995
71.163.222.64:443
86.175.7.7:2222
172.242.156.50:995
78.96.192.26:443
173.245.152.231:443
98.32.60.217:443
173.175.29.210:443
5.13.84.244:995
185.145.113.249:443
188.214.209.215:443
46.102.79.11:443
67.246.16.250:995
207.255.161.8:32100
69.11.247.242:443
69.92.54.95:995
200.113.201.83:995
82.81.172.21:443
74.134.46.7:443
216.163.4.132:443
200.75.136.78:443
188.241.235.29:2222
73.217.4.42:443
96.244.45.155:443
35.142.12.163:2222
80.195.103.146:2222
49.207.105.25:443
72.142.106.198:465
66.26.160.37:443
72.177.157.217:995
96.18.240.158:443
188.241.226.79:443
203.198.96.69:443
207.246.71.122:443
144.202.48.107:443
140.82.21.191:443
45.77.215.141:443
187.155.74.5:443
74.75.216.202:443
24.44.180.236:2222
24.43.22.220:993
108.188.116.179:443
76.170.77.99:443
100.4.173.223:443
175.111.128.234:443
98.23.23.88:22
68.60.221.169:465
67.165.206.193:995
172.78.30.215:443
97.118.54.251:993
83.110.222.11:443
100.19.7.242:443
190.78.139.208:2078
174.20.146.107:995
24.46.40.189:2222
93.118.206.208:995
24.164.79.147:443
103.76.160.110:443
72.190.101.70:443
47.153.115.154:993
184.180.157.203:2222
50.104.68.223:443
200.113.201.83:993
24.139.132.70:443
103.238.231.40:443
24.138.69.84:443
24.202.42.48:2222
72.204.242.138:443
72.204.242.138:20
24.42.14.241:995
98.115.138.61:443
96.56.237.174:990
74.193.197.246:443
47.153.115.154:465
64.19.74.29:995
70.168.130.172:443
189.160.203.110:443
207.255.161.8:32102
189.236.166.167:443
76.187.8.160:443
68.4.137.211:443
68.174.15.223:443
76.86.57.179:2222
72.28.255.159:995
193.248.44.2:2222
75.183.171.155:3389
73.226.220.56:443
101.108.2.74:443
173.172.205.216:443
173.3.132.17:995
207.255.161.8:32103
75.137.239.211:443
68.49.120.179:443
50.244.112.106:443
206.51.202.106:50003
82.127.193.151:2222
207.255.161.8:2087
207.255.161.8:2222
82.37.242.8:443
24.152.219.253:995
2.50.47.97:2222
46.214.62.199:443
72.204.242.138:53
72.29.181.77:2078
199.247.16.80:443
71.88.168.176:443
2.50.171.142:443
67.83.54.76:2222
70.174.3.241:443
47.153.115.154:995
80.240.26.178:443
207.246.75.201:443
24.122.157.93:443
47.146.169.85:443
199.247.22.145:443
61.3.185.233:443
79.113.242.225:443
79.114.199.39:443
217.162.149.212:443
209.182.122.217:443
203.122.7.82:443
27.212.178.30:995
81.245.66.237:995
118.167.117.183:443
107.2.148.99:443
219.92.104.54:443
74.75.237.11:443
96.35.170.82:2222
211.24.72.253:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exepid process 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 3392 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 3392 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 3392 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 3392 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.execmd.exedescription pid process target process PID 3424 wrote to memory of 3392 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe PID 3424 wrote to memory of 3392 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe PID 3424 wrote to memory of 3392 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe PID 3424 wrote to memory of 512 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe cmd.exe PID 3424 wrote to memory of 512 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe cmd.exe PID 3424 wrote to memory of 512 3424 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe cmd.exe PID 512 wrote to memory of 936 512 cmd.exe PING.EXE PID 512 wrote to memory of 936 512 cmd.exe PING.EXE PID 512 wrote to memory of 936 512 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe"C:\Users\Admin\AppData\Local\Temp\61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exeC:\Users\Admin\AppData\Local\Temp\61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337e.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/512-119-0x0000000000000000-mapping.dmp
-
memory/936-120-0x0000000000000000-mapping.dmp
-
memory/3392-116-0x0000000000000000-mapping.dmp
-
memory/3392-117-0x00000000006F0000-0x000000000079E000-memory.dmpFilesize
696KB
-
memory/3424-115-0x0000000000400000-0x000000000069F000-memory.dmpFilesize
2.6MB
-
memory/3424-114-0x0000000000810000-0x0000000000847000-memory.dmpFilesize
220KB