Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 10:37
Behavioral task
behavioral1
Sample
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe
Resource
win10v2004-en-20220113
General
-
Target
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe
-
Size
1.1MB
-
MD5
e246afedc817015727f4c2d257bd6f80
-
SHA1
ba6380216f7e62e3e32d129210a9f13f9bc4f3b5
-
SHA256
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf
-
SHA512
92c0226b49f52703c591f7c48b499b77178d87c11d6a1d8ab5d262112f5c05ed27db530ac12289c87e863a1915dc40b346e3d61c47fee2c586f7e0324a25c360
Malware Config
Extracted
qakbot
324.142
spx136
1591698756
184.180.157.203:2222
47.136.224.60:443
5.13.97.215:995
73.101.211.117:443
104.221.4.11:2222
203.33.139.134:443
151.73.124.242:443
76.111.128.194:443
72.209.191.27:443
64.19.74.29:995
72.204.242.138:990
45.45.51.182:2222
173.22.120.11:2222
75.183.135.48:443
81.245.66.237:995
188.27.68.239:443
207.255.161.8:2078
199.247.22.145:443
76.187.8.160:443
173.172.205.216:443
108.30.125.94:443
66.208.105.6:443
207.255.161.8:32103
50.29.181.193:995
200.75.136.78:443
108.39.93.45:443
199.247.16.80:443
149.71.50.158:443
47.222.40.131:443
79.119.67.149:443
185.246.9.69:995
65.96.36.157:443
88.201.103.165:443
108.54.205.207:443
178.168.50.66:443
5.14.59.85:443
81.103.144.77:443
217.162.149.212:443
67.246.16.250:995
73.226.220.56:443
5.13.99.38:995
31.5.26.171:443
108.28.90.129:443
188.27.6.170:443
70.183.127.6:995
98.114.185.3:443
50.104.68.223:443
72.28.255.159:995
5.15.32.225:443
36.77.151.211:443
82.178.48.65:443
140.82.21.191:443
98.32.60.217:443
47.146.169.85:443
75.110.250.89:443
35.142.12.163:2222
76.169.33.226:443
75.183.171.155:3389
96.37.137.42:443
67.209.195.198:3389
80.195.103.146:2222
74.56.167.31:443
76.86.57.179:2222
216.201.162.158:995
71.185.60.227:443
86.126.117.54:995
49.191.4.245:443
188.209.108.87:2222
217.66.244.183:443
103.110.49.88:443
79.117.161.67:21
42.3.8.102:443
178.87.254.174:443
24.201.79.208:2078
72.204.242.138:443
86.126.97.183:2222
74.135.37.79:443
2.45.53.40:2222
79.115.152.163:443
184.96.155.4:993
70.168.130.172:443
188.26.249.181:443
101.108.115.107:443
68.174.15.223:443
98.115.138.61:443
82.77.169.118:2222
75.87.161.32:995
41.231.234.147:443
67.250.184.157:443
207.162.184.228:443
189.231.198.212:443
96.56.237.174:993
97.93.211.17:443
47.138.200.85:443
72.204.242.138:50001
182.181.39.40:995
190.198.124.212:2078
72.36.59.46:2222
96.35.170.82:2222
173.3.132.17:995
76.30.66.244:443
69.246.151.5:995
68.49.120.179:443
69.92.54.95:995
50.244.112.10:443
197.165.220.106:443
207.255.161.8:32102
66.222.88.126:995
108.58.9.238:995
47.152.210.233:443
98.219.77.197:443
50.244.112.106:443
72.204.242.138:20
82.127.193.151:2222
65.100.247.6:2083
188.192.75.8:443
104.50.141.139:995
73.94.229.115:443
24.122.228.88:443
67.83.54.76:2222
72.29.181.77:2078
66.68.22.151:443
24.122.157.93:443
41.97.150.116:443
72.204.242.138:53
71.187.170.235:443
173.49.122.160:995
50.247.230.33:995
24.43.22.220:993
134.0.196.46:995
75.81.25.223:443
94.10.81.239:443
85.122.141.42:443
61.2.191.247:443
68.39.160.40:443
89.44.192.193:443
68.60.221.169:465
72.204.242.138:32100
72.204.242.138:6881
117.192.109.204:443
69.28.222.54:443
105.101.112.21:443
98.118.156.172:443
68.204.164.222:443
39.36.228.39:995
184.98.104.7:995
69.11.247.242:443
72.204.242.138:50003
5.107.208.94:2222
137.99.222.152:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exepid process 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 1072 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 1072 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.execmd.exedescription pid process target process PID 1616 wrote to memory of 1072 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe PID 1616 wrote to memory of 1072 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe PID 1616 wrote to memory of 1072 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe PID 1616 wrote to memory of 1072 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe PID 1616 wrote to memory of 556 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe cmd.exe PID 1616 wrote to memory of 556 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe cmd.exe PID 1616 wrote to memory of 556 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe cmd.exe PID 1616 wrote to memory of 556 1616 30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe cmd.exe PID 556 wrote to memory of 1360 556 cmd.exe PING.EXE PID 556 wrote to memory of 1360 556 cmd.exe PING.EXE PID 556 wrote to memory of 1360 556 cmd.exe PING.EXE PID 556 wrote to memory of 1360 556 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe"C:\Users\Admin\AppData\Local\Temp\30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exeC:\Users\Admin\AppData\Local\Temp\30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\30bd6ca5e375620639cace8b72d7e4499cf309d4a0aab3f1ba9fafce46f9e9cf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-58-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB
-
memory/1616-54-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB
-
memory/1616-55-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/1616-56-0x0000000000400000-0x0000000000526000-memory.dmpFilesize
1.1MB