Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
05-02-2022 12:19
Behavioral task
behavioral1
Sample
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe
Resource
win10v2004-en-20220113
General
-
Target
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe
-
Size
2.1MB
-
MD5
0c13ed40d1f23ab07e8e865ba5940a5c
-
SHA1
ddfa12a3e648dbd0fd60f60f0ff0f0d944308d92
-
SHA256
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43
-
SHA512
146b060d9dc02c2b663aef39dd8384c5960fb9bfbceeb52b8921ff531975486dbdcd54baddcad55e9f901741c424aba90360401d8c91429906af36ac4f2eaebf
Malware Config
Extracted
qakbot
324.75
spx89
1585917777
66.44.96.184:443
185.145.113.249:443
87.65.204.240:995
68.174.9.179:443
97.127.144.203:2222
76.180.69.236:443
24.234.86.201:995
188.173.185.139:443
83.25.10.201:2222
93.114.115.146:443
24.201.79.208:2078
65.116.179.83:443
5.70.173.217:443
207.155.106.187:443
5.14.187.133:443
73.163.242.114:443
84.117.60.157:443
90.192.191.3:443
100.33.132.135:443
96.232.203.15:443
71.217.112.41:2222
72.255.200.129:2222
81.106.46.63:443
188.27.17.115:443
78.96.177.188:443
173.175.29.210:443
47.41.3.40:443
68.39.207.79:443
68.82.125.234:443
24.26.1.14:2222
206.183.190.53:995
86.124.109.100:443
97.96.51.117:443
68.98.142.248:443
73.111.224.222:443
188.25.93.249:443
184.13.73.135:443
187.163.101.137:995
86.122.236.97:443
86.123.95.59:2222
95.77.237.115:443
120.147.65.97:2222
75.130.117.134:443
95.77.144.238:443
24.55.152.50:995
71.77.231.251:443
63.155.135.211:995
73.184.218.146:443
39.59.82.73:995
181.197.195.138:995
72.36.59.46:2222
174.60.164.63:443
79.119.248.1:443
84.247.55.190:443
98.243.187.85:443
98.215.176.247:443
69.202.163.99:443
72.90.243.117:0
73.23.194.75:443
24.228.7.174:443
79.113.173.185:443
71.221.224.19:2222
70.183.127.6:995
79.114.194.106:443
5.182.39.156:443
24.110.96.149:443
174.126.230.25:443
75.110.250.89:443
24.184.5.251:2222
86.189.181.83:443
173.22.120.11:2222
71.11.209.101:443
73.169.47.57:443
24.46.40.189:2222
46.214.69.150:443
75.110.93.212:443
70.57.15.187:993
72.190.124.29:443
74.102.83.89:443
23.24.115.181:443
73.214.231.2:443
72.16.212.107:465
173.3.132.17:995
24.229.245.124:995
49.191.6.183:995
47.205.231.60:443
98.204.224.168:995
70.62.160.186:6883
71.187.170.235:443
85.7.22.186:2222
96.35.170.82:2222
72.142.106.198:465
46.214.62.199:443
68.200.184.210:995
24.202.42.48:2222
108.54.103.234:443
72.80.137.215:443
94.52.160.218:443
70.74.159.126:2222
201.152.203.196:995
172.95.42.35:443
216.201.162.158:443
98.219.77.197:443
108.30.161.143:443
31.5.189.71:443
69.92.54.95:995
108.190.151.108:2222
89.46.27.192:443
71.213.61.215:995
96.248.125.34:443
75.81.25.223:995
47.153.115.154:995
72.38.44.119:995
67.250.184.157:443
151.205.102.42:443
47.153.115.154:443
96.234.20.230:443
173.62.161.126:443
73.101.211.117:443
71.77.252.14:2222
190.136.118.156:443
108.27.217.44:443
173.79.220.156:443
46.214.86.45:443
208.126.142.17:443
66.222.88.126:995
46.153.111.112:995
104.36.135.227:443
70.95.94.91:2078
190.133.53.89:995
68.49.120.179:443
188.25.237.208:443
68.204.164.222:443
79.114.2.187:443
213.31.203.38:2222
5.12.213.152:2222
81.133.234.36:2222
46.228.183.228:443
50.29.181.193:995
95.76.187.199:443
75.182.220.196:2222
121.122.66.130:443
5.13.126.243:443
66.26.160.37:443
72.132.249.144:995
74.33.70.220:443
98.199.226.41:443
68.46.142.48:995
70.126.76.75:443
86.123.17.28:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exepid process 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 1396 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 1396 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.execmd.exedescription pid process target process PID 1216 wrote to memory of 1396 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe PID 1216 wrote to memory of 1396 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe PID 1216 wrote to memory of 1396 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe PID 1216 wrote to memory of 1396 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe PID 1216 wrote to memory of 1548 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe cmd.exe PID 1216 wrote to memory of 1548 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe cmd.exe PID 1216 wrote to memory of 1548 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe cmd.exe PID 1216 wrote to memory of 1548 1216 9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe cmd.exe PID 1548 wrote to memory of 1740 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1740 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1740 1548 cmd.exe PING.EXE PID 1548 wrote to memory of 1740 1548 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe"C:\Users\Admin\AppData\Local\Temp\9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exeC:\Users\Admin\AppData\Local\Temp\9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9ceac97816e90e7c5922dce12954dcc9c34d6542dbe06cf766db55b366fefb43.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-53-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1216-54-0x00000000002D0000-0x0000000000309000-memory.dmpFilesize
228KB
-
memory/1216-56-0x0000000000400000-0x0000000000618000-memory.dmpFilesize
2.1MB
-
memory/1396-57-0x0000000000400000-0x0000000000618000-memory.dmpFilesize
2.1MB