Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
liveried/sufferer.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
liveried/sufferer.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
liveried/waddling.cmd
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
liveried/waddling.cmd
Resource
win10v2004-20220901-en
General
-
Target
Contract.lnk
-
Size
1KB
-
MD5
ad079ab2d276ebb2d1fd21c312470961
-
SHA1
d0df3afa594bfecfcf11cb93c2847462d6a1d661
-
SHA256
2525a45f8cd187363a9de42cbf14bc00c6d77ddb28246169a1dfa01a89cd9a9c
-
SHA512
14e5f59fddb33efa78b698e31706b9125c135f545c78ed6977f3bb571cd059f5b4e723ccf7ab1f1444a4dc68cef825094e33449cc2c49f4526d4c89765215493
Malware Config
Extracted
qakbot
403.1051
BB04
1666265103
102.156.82.38:995
152.170.17.136:443
216.131.22.236:995
70.173.248.13:443
14.246.151.175:443
160.179.32.101:995
118.175.242.26:995
186.188.80.202:443
41.69.181.145:443
156.220.14.160:993
201.68.209.47:32101
206.1.172.1:443
156.217.185.90:995
190.74.4.20:443
217.78.49.161:443
154.181.199.80:995
200.233.108.153:993
175.205.2.54:443
198.2.51.242:993
181.164.194.228:443
197.204.180.90:443
201.210.121.49:2222
144.202.15.58:443
41.228.249.243:995
200.155.61.245:995
45.230.169.132:995
197.206.119.7:443
193.3.19.137:443
41.105.5.123:443
103.156.237.170:443
73.96.24.39:443
201.210.119.28:993
136.232.184.134:995
105.105.0.165:443
190.193.180.228:443
190.204.101.210:2222
190.33.87.140:443
200.93.11.28:2222
181.56.171.3:995
181.168.145.94:443
94.36.5.31:443
5.163.177.234:443
167.58.254.85:443
191.84.67.34:443
41.99.101.231:443
206.1.233.138:443
58.186.75.42:443
206.1.181.103:443
181.141.3.126:443
187.143.131.190:2222
82.12.196.197:443
200.44.222.59:2222
105.99.146.94:443
187.198.16.39:443
197.2.227.65:443
201.171.199.216:443
105.108.252.186:443
186.213.214.13:2222
85.242.200.96:443
41.97.228.210:443
105.158.71.149:443
41.62.218.170:443
105.103.39.73:443
206.1.233.162:2087
190.203.116.63:2222
152.171.41.171:443
78.179.135.247:443
41.141.216.137:995
200.155.61.245:443
167.58.86.35:995
105.96.250.243:443
189.110.3.60:2222
41.100.121.175:443
41.143.221.72:443
41.111.121.4:995
160.177.88.185:443
41.100.94.61:443
72.88.245.71:443
41.101.153.206:443
41.103.68.151:443
177.152.65.142:443
42.116.54.220:443
181.197.41.173:443
160.177.145.229:443
179.105.126.196:995
2.152.181.194:995
125.26.173.239:443
31.166.182.166:443
196.65.219.83:443
220.134.54.185:2222
202.5.53.143:443
74.141.38.107:443
78.184.31.100:443
41.104.28.115:995
68.35.151.16:443
149.126.159.254:443
109.49.47.10:80
134.35.1.15:443
220.123.29.76:443
201.223.175.208:32100
190.33.241.216:443
201.205.130.251:995
216.131.22.236:443
75.157.229.63:443
163.182.177.80:443
201.212.173.78:443
186.93.143.86:2222
106.243.197.122:443
186.188.96.197:443
181.55.106.237:443
45.184.179.188:2222
88.229.17.133:443
104.237.6.167:443
102.185.146.113:995
186.144.129.196:443
186.48.244.74:443
190.24.54.187:995
186.177.93.18:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4856 6.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 regsvr32.exe 1508 regsvr32.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe 5032 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1508 regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4432 wrote to memory of 4928 4432 cmd.exe 82 PID 4432 wrote to memory of 4928 4432 cmd.exe 82 PID 4928 wrote to memory of 4856 4928 cmd.exe 83 PID 4928 wrote to memory of 4856 4928 cmd.exe 83 PID 4856 wrote to memory of 1508 4856 6.exe 84 PID 4856 wrote to memory of 1508 4856 6.exe 84 PID 4856 wrote to memory of 1508 4856 6.exe 84 PID 1508 wrote to memory of 5032 1508 regsvr32.exe 85 PID 1508 wrote to memory of 5032 1508 regsvr32.exe 85 PID 1508 wrote to memory of 5032 1508 regsvr32.exe 85 PID 1508 wrote to memory of 5032 1508 regsvr32.exe 85 PID 1508 wrote to memory of 5032 1508 regsvr32.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Contract.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c liveried\waddling.cmd reg sv r2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6.exeC:\Users\Admin\AppData\Local\Temp\6.exe liveried\sufferer.ssd3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\regsvr32.exeliveried\sufferer.ssd4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022