Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 10:31
Behavioral task
behavioral1
Sample
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe
Resource
win7-en-20211208
General
-
Target
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe
-
Size
2.3MB
-
MD5
463a5753d69ef09b1cab76b94f0e4c38
-
SHA1
e09afac5154e6b42f037e2dab8fab5666eba9be4
-
SHA256
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07
-
SHA512
076509e61b460e270bfd142bd5498cf594b393728eaa719f0dfbcb17ab05e55c0093c46017d91aa5582c067f0117ab63df600c41740f1c8bde9b1d3171492de5
Malware Config
Extracted
qakbot
324.127
spx97
1586971769
72.214.55.147:995
78.96.64.230:443
100.38.123.22:443
47.205.231.60:443
185.145.113.249:443
72.16.212.107:465
94.52.124.226:443
72.255.200.69:2222
73.56.2.167:443
67.249.222.14:443
71.58.21.235:443
79.113.193.29:443
96.35.170.82:2222
76.111.128.194:443
181.126.86.223:443
67.209.195.198:3389
47.146.169.85:443
47.39.76.74:443
67.131.59.17:443
71.11.209.101:443
197.210.96.222:995
98.197.254.40:443
206.255.163.120:443
189.163.185.56:443
72.218.167.183:995
66.26.160.37:443
173.174.94.95:443
189.140.23.219:443
173.3.132.17:995
137.103.143.124:443
24.229.245.124:995
187.212.143.197:443
172.87.134.226:443
100.1.239.189:443
68.46.142.48:995
72.78.198.100:443
102.186.58.240:6881
67.197.97.144:443
74.33.70.30:443
187.138.213.205:443
23.240.76.67:443
76.187.8.160:443
98.244.249.165:995
98.27.176.35:443
68.225.250.136:443
85.121.42.12:443
24.28.183.107:995
46.214.139.70:443
98.243.187.85:443
186.135.127.3:443
47.40.244.237:443
71.77.252.14:2222
5.14.253.163:443
73.23.194.75:443
79.113.219.121:443
94.52.151.23:443
24.191.214.43:2083
68.60.221.169:465
68.98.142.248:443
96.57.237.162:443
72.29.181.77:2222
96.232.203.15:443
190.79.43.28:2078
93.118.221.204:443
50.104.67.101:443
86.125.138.141:995
95.77.204.208:443
108.30.161.143:443
193.23.5.134:443
174.104.23.7:443
86.126.126.75:443
72.36.59.46:2222
74.109.200.208:443
24.183.39.93:443
50.247.230.33:995
79.115.121.46:443
71.77.231.251:443
89.34.231.30:443
79.118.149.0:443
71.195.111.107:443
71.10.43.79:443
98.210.41.34:0
199.241.223.66:443
188.27.55.226:443
76.187.97.98:2222
173.197.155.139:443
86.125.208.132:443
50.244.112.10:443
58.177.238.186:443
84.117.115.162:443
24.37.178.158:990
152.32.80.37:443
95.77.223.148:443
24.110.96.149:443
77.159.149.74:443
24.210.45.215:443
72.190.101.70:443
71.187.170.235:443
24.110.14.40:443
100.4.185.8:443
47.153.115.154:993
78.96.245.58:443
188.27.67.96:443
12.5.37.3:443
216.163.4.91:443
72.172.49.164:443
47.202.98.230:443
5.2.149.216:443
24.168.237.215:443
107.2.148.99:443
156.96.45.215:443
98.213.28.175:443
72.16.57.99:443
47.153.115.154:995
75.183.171.155:3389
74.102.83.89:443
184.98.104.7:995
69.206.6.71:2222
79.113.207.142:443
74.138.18.247:443
50.78.93.74:443
84.117.89.128:443
174.131.80.220:995
24.32.119.146:443
64.121.114.87:443
68.49.120.179:443
46.214.62.199:443
68.1.171.93:443
46.214.153.33:443
173.30.188.202:2222
65.60.228.130:443
24.44.180.236:2222
73.87.97.153:32103
89.36.249.46:443
86.120.98.221:443
98.116.62.242:443
89.43.136.239:443
93.26.180.87:443
137.119.71.87:443
47.157.85.96:443
24.234.86.201:995
86.22.41.176:443
98.148.177.77:443
100.43.250.74:995
189.183.74.53:995
85.122.141.42:995
66.25.168.167:2222
59.94.165.115:443
86.121.197.61:443
86.123.130.104:443
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Exbisaovli\pxucuapf.exe cryptone -
Drops startup file 1 IoCs
Processes:
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\pxucuapf.lnk c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe -
Loads dropped DLL 1 IoCs
Processes:
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exepid process 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exec20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exec20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exepid process 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe 1252 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe 1252 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exetaskeng.exec20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.execmd.exedescription pid process target process PID 1628 wrote to memory of 1252 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1628 wrote to memory of 1252 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1628 wrote to memory of 1252 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1628 wrote to memory of 1252 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1628 wrote to memory of 1716 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1628 wrote to memory of 1716 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1628 wrote to memory of 1716 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1628 wrote to memory of 1716 1628 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1408 wrote to memory of 1388 1408 taskeng.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1408 wrote to memory of 1388 1408 taskeng.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1408 wrote to memory of 1388 1408 taskeng.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1408 wrote to memory of 1388 1408 taskeng.exe c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe PID 1388 wrote to memory of 628 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 628 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 628 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 628 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1560 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1560 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1560 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1560 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 2028 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 2028 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 2028 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 2028 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1944 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1944 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1944 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1944 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1820 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1820 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1820 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1820 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1160 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1160 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1160 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1160 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1624 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1624 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1624 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1624 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1520 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1520 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1520 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1520 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe reg.exe PID 1388 wrote to memory of 1660 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe cmd.exe PID 1388 wrote to memory of 1660 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe cmd.exe PID 1388 wrote to memory of 1660 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe cmd.exe PID 1388 wrote to memory of 1660 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe cmd.exe PID 1388 wrote to memory of 304 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1388 wrote to memory of 304 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1388 wrote to memory of 304 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1388 wrote to memory of 304 1388 c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe schtasks.exe PID 1660 wrote to memory of 1680 1660 cmd.exe PING.EXE PID 1660 wrote to memory of 1680 1660 cmd.exe PING.EXE PID 1660 wrote to memory of 1680 1660 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe"C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exeC:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sbplkcan /tr "\"C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe\" /I sbplkcan" /SC ONCE /Z /ST 10:34 /ET 10:462⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {BD421E51-0C8D-494B-B768-9C32509FAA31} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exeC:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe /I sbplkcan2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN sbplkcan3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Exbisaovli\pxucuapf.exeMD5
463a5753d69ef09b1cab76b94f0e4c38
SHA1e09afac5154e6b42f037e2dab8fab5666eba9be4
SHA256c20dc2c71d2e44b1a8f469fff690855fffb1c14092d383ce19eef8c8ae9eaa07
SHA512076509e61b460e270bfd142bd5498cf594b393728eaa719f0dfbcb17ab05e55c0093c46017d91aa5582c067f0117ab63df600c41740f1c8bde9b1d3171492de5
-
memory/1252-57-0x0000000000400000-0x0000000000647000-memory.dmpFilesize
2.3MB
-
memory/1388-60-0x0000000000400000-0x0000000000647000-memory.dmpFilesize
2.3MB
-
memory/1628-53-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1628-54-0x0000000000220000-0x0000000000259000-memory.dmpFilesize
228KB
-
memory/1628-56-0x0000000000400000-0x0000000000647000-memory.dmpFilesize
2.3MB