Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
ComplianceReportCopy.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ComplianceReportCopy.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
standby/custom.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
standby/custom.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
standby/overbalances.cmd
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
standby/overbalances.cmd
Resource
win10v2004-20220901-en
General
-
Target
ComplianceReportCopy.lnk
-
Size
1KB
-
MD5
2bd5a02c25e5c84b0884290af6ecfcf6
-
SHA1
45770ea357497ffec1104d1f00dfd8314c6ed0d6
-
SHA256
0264a38354df68d37ab1679c1d4182d65a85b613d74a795b6fbf464209d4e4f1
-
SHA512
cefdd9e713d37729a3c71bd63be830de56f1ffdd7e3a0af9fe1240b9761fcf447e2ea30c9fd137908b1c8edc1b66c8ea9538f7cf489de5bfadcec29cc162251c
Malware Config
Extracted
qakbot
403.1051
obama216
1666689942
24.116.45.121:443
24.206.27.39:443
71.199.168.185:443
70.115.104.126:443
190.24.45.24:995
24.9.220.167:443
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
197.202.196.43:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
debauchedBrain.compid process 368 debauchedBrain.com -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 784 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 932 regsvr32.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe 1608 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 932 regsvr32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
cmd.execmd.exedebauchedBrain.comregsvr32.exedescription pid process target process PID 1048 wrote to memory of 784 1048 cmd.exe cmd.exe PID 1048 wrote to memory of 784 1048 cmd.exe cmd.exe PID 1048 wrote to memory of 784 1048 cmd.exe cmd.exe PID 784 wrote to memory of 368 784 cmd.exe debauchedBrain.com PID 784 wrote to memory of 368 784 cmd.exe debauchedBrain.com PID 784 wrote to memory of 368 784 cmd.exe debauchedBrain.com PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 368 wrote to memory of 932 368 debauchedBrain.com regsvr32.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe PID 932 wrote to memory of 1608 932 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ComplianceReportCopy.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c standby\overbalances.cmd regs2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\debauchedBrain.comC:\Users\Admin\AppData\Local\Temp\\debauchedBrain.com standby\custom.dat3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exestandby\custom.dat4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\debauchedBrain.comFilesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198
-
\Users\Admin\AppData\Local\Temp\debauchedBrain.comFilesize
19KB
MD559bce9f07985f8a4204f4d6554cff708
SHA1645c424974fbe5fe7a04cac73f1c23c96e1570b8
SHA256ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57
SHA5123cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198
-
memory/368-93-0x0000000000000000-mapping.dmp
-
memory/784-88-0x0000000000000000-mapping.dmp
-
memory/932-99-0x0000000001E30000-0x0000000001E59000-memory.dmpFilesize
164KB
-
memory/932-96-0x0000000000000000-mapping.dmp
-
memory/932-97-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/932-98-0x0000000001D70000-0x0000000001DF0000-memory.dmpFilesize
512KB
-
memory/932-100-0x0000000001E30000-0x0000000001E59000-memory.dmpFilesize
164KB
-
memory/932-101-0x0000000001E30000-0x0000000001E59000-memory.dmpFilesize
164KB
-
memory/932-102-0x00000000004E0000-0x0000000000509000-memory.dmpFilesize
164KB
-
memory/932-103-0x0000000001E30000-0x0000000001E59000-memory.dmpFilesize
164KB
-
memory/932-107-0x0000000001E30000-0x0000000001E59000-memory.dmpFilesize
164KB
-
memory/1048-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmpFilesize
8KB
-
memory/1608-104-0x0000000000000000-mapping.dmp
-
memory/1608-106-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1608-108-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB