General
Target

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe

Filesize

2MB

Completed

21-05-2022 10:54

Task

behavioral2

Score
10/10
MD5

7d05b151fd2b28582cfca8ca8ceaa58f

SHA1

6d4d8baf550550ebd1e15f3b3a697f8516fe79cf

SHA256

736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9

SHA256

5e6b7105b5e36581a43b9d6e6e460c6ea08618a3b8fbad52f2aafdee4f4162dc40e6a723b03488dcf7f200ee251f3588c41cc41149739dfccc65988b29b77fb2

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

102.41.122.185:995

67.131.59.17:443

184.98.104.7:995

69.11.247.242:443

201.127.4.70:443

72.204.242.138:50003

189.231.198.212:443

5.14.44.173:2222

5.14.76.156:443

151.205.102.42:443

179.51.23.31:443

72.190.101.70:443

73.76.47.127:443

80.240.26.178:443

72.36.59.46:2222

73.209.113.58:443

68.49.120.179:443

69.92.54.95:995

187.19.151.218:995

50.244.112.10:443

66.222.88.126:995

207.255.161.8:32102

108.58.9.238:995

105.98.154.57:443

98.219.77.197:443

216.163.4.91:443

47.152.210.233:443

178.223.17.74:995

72.204.242.138:20

82.127.193.151:2222

Signatures 7

Filter: none

Discovery
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings
    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks SCSI registry key(s)
    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
  • Runs ping.exe
    PING.EXE

    TTPs

    Remote System Discovery

    Reported IOCs

    pidprocess
    4804PING.EXE
  • Suspicious behavior: EnumeratesProcesses
    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe

    Reported IOCs

    pidprocess
    1124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    1124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    3312736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    3312736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    3312736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    3312736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
  • Suspicious use of WriteProcessMemory
    736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1124 wrote to memory of 33121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    PID 1124 wrote to memory of 33121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    PID 1124 wrote to memory of 33121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    PID 1124 wrote to memory of 31121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.execmd.exe
    PID 1124 wrote to memory of 31121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.execmd.exe
    PID 1124 wrote to memory of 31121124736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.execmd.exe
    PID 3112 wrote to memory of 48043112cmd.exePING.EXE
    PID 3112 wrote to memory of 48043112cmd.exePING.EXE
    PID 3112 wrote to memory of 48043112cmd.exePING.EXE
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
    "C:\Users\Admin\AppData\Local\Temp\736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe"
    Checks computer location settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe
      C:\Users\Admin\AppData\Local\Temp\736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe /C
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      PID:3312
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\736c373f09596e706dae01b4cb6a57647046f5047c8b67eb418d51b819a29ac9.exe"
      Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Windows\SysWOW64\PING.EXE
        ping.exe -n 6 127.0.0.1
        Runs ping.exe
        PID:4804
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1124-130-0x0000000000920000-0x0000000000957000-memory.dmp

                        • memory/1124-131-0x0000000000400000-0x000000000069F000-memory.dmp

                        • memory/3112-134-0x0000000000000000-mapping.dmp

                        • memory/3312-132-0x0000000000000000-mapping.dmp

                        • memory/3312-133-0x0000000000400000-0x000000000069F000-memory.dmp

                        • memory/4804-135-0x0000000000000000-mapping.dmp