Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-04-2022 14:25
Static task
static1
Behavioral task
behavioral1
Sample
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe
Resource
win7-20220414-en
General
-
Target
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe
-
Size
339KB
-
MD5
6ec710592f870d7235255f1343ae8f02
-
SHA1
f51e09560aeb67f18abbc82509e94bd034272e6e
-
SHA256
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7
-
SHA512
6a3f804b1220d21807d6d9921792e172b313a592545e61fbdbc9f9af13ea946f0bab5c153470bbe89d7a1cbbea7d061af843eef3a5f13bb2b6801edf88a550e6
Malware Config
Extracted
qakbot
325.59
abc027
1604574287
93.86.252.177:995
184.98.97.227:995
188.25.24.21:2222
1.54.190.204:443
89.137.211.239:443
78.101.234.58:443
41.206.131.166:443
87.27.110.90:2222
47.44.217.98:443
197.45.110.165:995
217.133.54.140:32100
41.97.170.119:443
185.246.9.69:995
90.53.232.130:2222
72.186.1.237:443
144.139.230.139:443
86.164.27.33:2222
185.105.131.233:443
90.146.209.224:2222
108.46.145.30:443
85.186.122.190:443
208.99.100.129:443
73.55.254.225:443
61.1.206.44:443
72.209.191.27:443
67.82.244.199:2222
64.185.5.157:443
68.13.99.24:443
176.181.247.197:443
202.141.244.118:995
75.136.40.155:443
45.243.77.75:443
92.59.35.196:2083
71.88.104.107:443
37.104.31.132:995
109.205.204.229:2222
63.155.67.114:995
77.89.10.4:2222
216.201.162.158:443
216.215.77.18:2222
67.78.151.218:2222
93.113.177.152:443
201.127.70.175:2222
141.158.47.123:443
5.32.41.46:443
83.110.75.224:443
69.11.247.242:443
45.77.193.83:443
207.246.75.201:443
184.21.136.237:443
108.31.15.10:995
217.165.96.127:990
98.16.204.189:995
37.104.237.11:443
72.36.59.46:2222
172.87.157.235:443
81.133.234.36:2222
24.179.13.119:443
86.98.59.251:2222
82.210.157.185:443
81.97.154.100:443
203.198.96.164:443
68.186.192.69:443
83.110.109.140:2222
72.204.242.138:443
176.58.132.212:2222
41.42.166.30:443
24.231.54.185:2222
74.129.26.119:443
188.27.32.167:443
2.50.159.189:2222
84.126.11.130:443
85.105.29.218:443
2.50.58.76:443
178.87.225.167:443
86.122.18.250:443
72.190.101.70:443
217.162.149.212:443
96.237.141.134:995
24.152.219.253:995
197.133.209.88:443
41.238.238.233:443
74.75.216.202:443
45.63.107.192:2222
217.165.2.92:995
45.63.107.192:995
45.63.107.192:443
37.106.7.143:443
45.32.154.10:443
71.187.177.20:443
120.150.218.241:443
2.50.167.56:443
2.49.28.18:2222
83.103.226.20:995
2.50.110.49:2078
75.87.161.32:995
68.174.15.223:443
39.36.77.219:995
188.25.97.18:443
86.140.82.66:443
72.204.242.138:465
50.209.125.234:995
2.50.47.130:2222
31.35.28.29:443
47.146.39.147:443
188.152.23.81:2222
68.15.109.125:443
190.220.8.10:995
72.66.47.70:443
149.28.99.97:995
82.12.157.95:995
191.84.14.174:443
149.28.99.97:443
149.28.99.97:2222
79.113.119.125:443
45.32.155.12:443
78.97.110.47:443
69.40.22.180:443
74.75.237.11:443
72.82.15.220:443
86.98.145.152:2222
47.22.148.6:443
70.168.130.172:995
78.96.199.79:443
50.244.112.10:995
68.225.60.77:443
47.137.242.79:443
98.26.50.62:995
71.197.126.250:443
46.53.60.8:443
68.190.152.98:443
82.127.125.209:2222
184.55.32.182:443
24.205.42.241:443
82.127.125.209:990
2.51.247.69:995
66.215.32.224:443
45.32.155.12:2222
96.30.198.161:443
45.32.165.134:443
45.63.104.123:443
118.100.108.25:443
140.82.27.132:443
82.76.47.211:443
207.246.70.216:443
117.241.53.164:443
120.150.60.189:995
80.195.103.146:2222
98.116.20.194:443
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\kakzdrw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Rfzio\\wmmue.exe\"" 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exepid process 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 1660 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 1660 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 268 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exetaskeng.exedescription pid process target process PID 732 wrote to memory of 1660 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 732 wrote to memory of 1660 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 732 wrote to memory of 1660 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 732 wrote to memory of 1660 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 732 wrote to memory of 1772 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe schtasks.exe PID 732 wrote to memory of 1772 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe schtasks.exe PID 732 wrote to memory of 1772 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe schtasks.exe PID 732 wrote to memory of 1772 732 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe schtasks.exe PID 1356 wrote to memory of 268 1356 taskeng.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 1356 wrote to memory of 268 1356 taskeng.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 1356 wrote to memory of 268 1356 taskeng.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe PID 1356 wrote to memory of 268 1356 taskeng.exe 4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe"C:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exeC:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nzbkgdju /tr "\"C:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe\" /I nzbkgdju" /SC ONCE /Z /ST 18:09 /ET 18:212⤵
- Creates scheduled task(s)
PID:1772
-
C:\Windows\system32\taskeng.exetaskeng.exe {2E8751FF-BF44-442F-8432-7779215B28CE} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exeC:\Users\Admin\AppData\Local\Temp\4efe4077d505425e64296f10f757d3fe682637d817c27e2325d4a6cf8b8617f7.exe /I nzbkgdju2⤵
- Suspicious behavior: EnumeratesProcesses
PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-62-0x0000000000000000-mapping.dmp
-
memory/268-64-0x0000000000220000-0x000000000027A000-memory.dmpFilesize
360KB
-
memory/268-65-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/732-54-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/732-55-0x0000000000250000-0x00000000002AA000-memory.dmpFilesize
360KB
-
memory/732-56-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1660-57-0x0000000000000000-mapping.dmp
-
memory/1660-59-0x0000000000230000-0x000000000028A000-memory.dmpFilesize
360KB
-
memory/1660-60-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1772-61-0x0000000000000000-mapping.dmp