Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2022, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
JG.js
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
JG.js
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
almond/lemur.dll
Resource
win7-20220901-en
windows7-x64
General
- Target JG.js
- Size 10KB
- Sample221121-pv75daeb7s
- SHA256 3b00174d5b42adf5da7fe896ce8baae14d67c52f79c49eed82bdf87e3a28d625
- MD5 6058a64332831c510b20951ccd49e839
- SHA1 6e42d13ca4a86c289c0d956db7eaca609ade5ee8
- SHA512 d48ddc0599a8df1771a5c4b4ed605c56b439e00b76dde58b2a2305e0a7b7a027814a603b63530331837e958d63cdd0027f110dad742d69fc1a9cb636c2a8eca8
- SSDEEP 192:7GwSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:7G/5Kk785UIhp/KTMhSeYmn2jiu5EjPH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.30
-
BB07
-
1669024152
-
69.119.123.159:2222
-
197.148.17.17:2078
-
174.104.184.149:443
-
12.172.173.82:995
-
91.68.227.219:443
-
85.241.180.94:443
-
83.7.53.150:443
-
213.22.188.57:2222
-
71.46.234.170:443
-
190.75.150.58:2222
-
86.98.15.100:995
-
89.115.196.99:443
-
83.31.254.67:2222
-
46.162.109.183:443
-
2.84.98.228:2222
-
78.69.251.252:2222
-
12.172.173.82:465
-
75.143.236.149:443
-
47.229.96.60:443
-
80.121.8.212:995
-
74.92.243.113:50000
-
86.225.214.138:2222
-
183.82.100.110:2222
-
86.175.128.143:443
-
105.103.41.128:990
-
121.122.99.151:995
-
82.121.237.106:2222
-
83.248.199.56:443
-
81.156.198.115:2222
-
24.228.132.224:2222
-
87.243.146.59:443
-
174.112.25.29:2078
-
84.35.26.14:995
-
174.45.15.123:443
-
83.110.90.214:995
-
87.65.160.87:995
-
172.90.139.138:2222
-
71.247.10.63:2083
-
47.41.154.250:443
-
80.103.77.44:2222
-
92.11.189.236:2222
-
81.229.117.95:2222
-
91.169.12.198:32100
-
62.31.130.138:465
-
188.92.64.68:443
-
58.186.75.42:443
-
85.59.61.52:2222
-
94.63.65.146:443
-
80.13.179.151:2222
-
24.206.27.39:443
-
170.253.25.35:443
-
157.231.42.190:995
-
184.153.132.82:443
-
174.101.111.4:443
-
23.240.47.58:995
-
217.128.91.196:2222
-
62.35.67.88:443
-
184.155.91.69:443
-
86.176.144.202:2222
-
86.213.224.109:2222
-
90.104.22.28:2222
-
76.80.180.154:995
-
174.77.209.5:443
-
184.176.154.83:995
-
58.247.115.126:995
-
69.133.162.35:443
-
71.183.236.133:443
-
102.47.130.52:995
-
103.141.50.117:995
-
116.75.63.124:443
-
70.66.199.12:443
-
92.185.204.18:2078
-
130.43.107.232:995
-
92.24.200.226:995
-
81.111.108.123:443
-
98.145.23.67:443
-
197.0.235.159:443
-
92.137.74.174:2222
-
92.207.132.174:2222
-
12.172.173.82:50001
-
76.127.192.23:443
-
12.172.173.82:21
-
176.142.207.63:443
-
83.110.223.247:443
-
71.247.10.63:50003
-
108.6.249.139:443
-
24.69.87.61:443
-
90.89.95.158:2222
-
89.129.109.27:2222
-
91.254.215.167:443
-
71.247.10.63:995
-
47.34.30.133:443
-
86.130.9.140:2222
-
70.64.77.115:443
-
87.223.80.45:443
-
180.151.104.143:443
-
109.57.68.154:443
-
103.55.67.180:443
-
75.99.125.238:2222
-
50.68.204.71:995
-
73.36.196.11:443
-
105.184.161.242:443
-
187.199.224.16:32103
-
105.103.41.128:32103
-
75.156.125.215:995
-
170.249.59.153:443
-
2.91.187.6:995
-
87.202.101.164:50000
-
105.103.41.128:465
-
74.66.134.24:443
-
172.117.139.142:995
-
87.1.202.122:443
-
105.103.41.128:2078
-
12.172.173.82:990
-
86.171.75.63:443
-
12.172.173.82:2087
-
105.103.41.128:22
-
24.142.218.202:443
-
66.191.69.18:995
-
45.248.169.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 regsvr32.exe 2400 regsvr32.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe 2480 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2400 regsvr32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4624 4572 wscript.exe 76 PID 4572 wrote to memory of 4624 4572 wscript.exe 76 PID 4624 wrote to memory of 2400 4624 regsvr32.exe 77 PID 4624 wrote to memory of 2400 4624 regsvr32.exe 77 PID 4624 wrote to memory of 2400 4624 regsvr32.exe 77 PID 2400 wrote to memory of 2480 2400 regsvr32.exe 84 PID 2400 wrote to memory of 2480 2400 regsvr32.exe 84 PID 2400 wrote to memory of 2480 2400 regsvr32.exe 84 PID 2400 wrote to memory of 2480 2400 regsvr32.exe 84 PID 2400 wrote to memory of 2480 2400 regsvr32.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\JG.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" almond\lemur.temp2⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\regsvr32.exealmond\lemur.temp3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
-