Resubmissions
05-12-2022 21:32
221205-1dpr9ahe72 1005-12-2022 21:12
221205-z2lj3abc8x 1005-12-2022 17:34
221205-v5vvpaeb7t 10Analysis
-
max time kernel
601s -
max time network
602s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 21:32
Static task
static1
Behavioral task
behavioral1
Sample
CX.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CX.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
glasses/astrophysics.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
glasses/astrophysics.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
glasses/caitiff.cmd
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
glasses/caitiff.cmd
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
glasses/certificated.cmd
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
glasses/certificated.cmd
Resource
win10v2004-20221111-en
General
-
Target
CX.lnk
-
Size
1KB
-
MD5
2cf243993914e5e59bb3f2336a1cec7e
-
SHA1
7985e21c3d6426b9aa6943a5849a0c6b69bfe1ed
-
SHA256
3b718372bc32b024b122a866999b4a6b3e67a0efe57803417700828203f2f78a
-
SHA512
0d14ba36241244a0eb70dc52621f445f39450dec88bb4f148675e2b7b2db2870bd1ea00fe1af6fae53f6a03293fb327dbae47dc0cba58f8a906470d054398116
Malware Config
Extracted
qakbot
404.46
BB08
1669902931
71.46.234.171:443
50.68.204.71:443
186.28.89.170:995
50.68.204.71:993
62.31.130.138:465
152.170.17.136:443
108.162.6.34:995
24.142.218.202:443
67.61.71.201:443
65.95.85.172:2222
50.232.21.70:995
76.184.95.190:993
47.16.69.220:2222
178.169.196.115:443
184.64.44.21:443
12.172.173.82:22
77.126.81.208:443
38.69.136.177:995
174.104.184.149:443
173.18.126.3:443
172.90.139.138:2222
183.82.100.110:2222
184.153.132.82:443
86.130.9.180:2222
83.7.54.186:443
66.191.69.18:995
186.64.67.9:443
142.118.49.193:2222
91.254.215.167:443
41.34.106.203:993
64.228.191.212:2222
24.64.114.59:50010
80.121.50.13:443
216.82.134.218:443
92.27.86.48:2222
102.158.156.142:443
87.221.197.110:2222
12.172.173.82:993
176.142.207.63:443
24.64.114.59:2222
109.76.27.33:443
90.27.44.76:2222
92.24.200.226:995
75.99.125.235:2222
173.239.94.212:443
73.22.121.210:443
200.109.14.93:2222
61.92.123.169:443
98.145.23.67:443
86.190.16.164:443
136.35.241.159:443
81.155.30.185:2222
91.169.12.198:32100
71.199.168.185:443
64.121.161.102:443
37.14.229.220:2222
12.172.173.82:995
94.63.65.146:443
190.39.199.51:443
103.141.50.117:995
38.166.100.147:2087
190.28.111.166:443
80.107.151.232:2222
69.119.123.159:2222
213.91.235.146:443
76.80.180.154:995
130.43.99.103:995
12.172.173.82:465
75.143.236.149:443
92.239.81.124:443
74.92.243.113:50000
109.145.40.125:443
75.98.154.19:443
88.126.94.4:50000
177.205.67.80:2222
121.122.99.223:995
66.180.226.117:2222
78.69.251.252:2222
105.99.88.96:443
92.189.214.236:2222
108.162.6.34:443
84.35.26.14:995
12.172.173.82:990
188.54.99.243:995
71.31.101.183:443
80.13.179.151:2222
90.119.197.132:2222
47.41.154.250:443
109.149.148.184:2222
82.9.210.36:443
75.161.233.194:995
81.229.117.95:2222
90.116.219.167:2222
90.162.45.154:2222
190.74.104.149:465
76.100.159.250:443
105.108.215.158:990
197.0.145.209:443
70.115.104.126:995
50.90.249.161:443
109.11.175.42:2222
119.82.121.63:443
80.0.74.165:443
24.64.114.59:3389
178.191.21.187:995
70.66.199.12:443
216.196.245.102:2083
82.36.36.76:443
71.247.10.63:995
184.155.91.69:443
201.208.139.250:2222
12.172.173.82:21
199.83.165.233:443
90.104.22.28:2222
184.176.154.83:995
92.207.132.174:2222
92.185.204.18:2078
69.133.162.35:443
2.99.47.198:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
cmd.exepid process 320 cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 436 rundll32.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe 1872 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 436 rundll32.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
cmd.execmd.execmd.exerundll32.exedescription pid process target process PID 936 wrote to memory of 320 936 cmd.exe cmd.exe PID 936 wrote to memory of 320 936 cmd.exe cmd.exe PID 936 wrote to memory of 320 936 cmd.exe cmd.exe PID 936 wrote to memory of 320 936 cmd.exe cmd.exe PID 320 wrote to memory of 676 320 cmd.exe cmd.exe PID 320 wrote to memory of 676 320 cmd.exe cmd.exe PID 320 wrote to memory of 676 320 cmd.exe cmd.exe PID 320 wrote to memory of 676 320 cmd.exe cmd.exe PID 676 wrote to memory of 1628 676 cmd.exe replace.exe PID 676 wrote to memory of 1628 676 cmd.exe replace.exe PID 676 wrote to memory of 1628 676 cmd.exe replace.exe PID 676 wrote to memory of 1628 676 cmd.exe replace.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 676 wrote to memory of 436 676 cmd.exe rundll32.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe PID 436 wrote to memory of 1872 436 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CX.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /q /c glasses\caitiff.cmd2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K glasses\certificated.cmd system rundl3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\replace.exereplace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A4⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32 glasses\\astrophysics.tmp,DrawThemeIcon4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-88-0x0000000000000000-mapping.dmp
-
memory/436-98-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/436-91-0x0000000000000000-mapping.dmp
-
memory/436-92-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/436-93-0x0000000000810000-0x0000000000883000-memory.dmpFilesize
460KB
-
memory/436-94-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/436-95-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/676-89-0x0000000000000000-mapping.dmp
-
memory/936-54-0x000007FEFBC71000-0x000007FEFBC73000-memory.dmpFilesize
8KB
-
memory/1628-90-0x0000000000000000-mapping.dmp
-
memory/1872-96-0x0000000000000000-mapping.dmp
-
memory/1872-99-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1872-100-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB