Resubmissions
05/12/2022, 21:32
221205-1dpr9ahe721005/12/2022, 21:12
221205-z2lj3abc8x1005/12/2022, 17:34
221205-v5vvpaeb7t10Analysis
- max time kernel
602s - max time network
510s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/12/2022, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
CX.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
CX.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
glasses/astrophysics.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
glasses/astrophysics.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
glasses/caitiff.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
glasses/caitiff.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
glasses/certificated.cmd
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral8
Sample
glasses/certificated.cmd
Resource
win10v2004-20221111-en
windows10-2004-x64
General
- Target CX.lnk
- Size 1KB
- Sample221205-1dpr9ahe72
- SHA256 3b718372bc32b024b122a866999b4a6b3e67a0efe57803417700828203f2f78a
- MD5 2cf243993914e5e59bb3f2336a1cec7e
- SHA1 7985e21c3d6426b9aa6943a5849a0c6b69bfe1ed
- SHA512 0d14ba36241244a0eb70dc52621f445f39450dec88bb4f148675e2b7b2db2870bd1ea00fe1af6fae53f6a03293fb327dbae47dc0cba58f8a906470d054398116
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
404.46
-
BB08
-
1669902931
-
71.46.234.171:443
-
50.68.204.71:443
-
186.28.89.170:995
-
50.68.204.71:993
-
62.31.130.138:465
-
152.170.17.136:443
-
108.162.6.34:995
-
24.142.218.202:443
-
67.61.71.201:443
-
65.95.85.172:2222
-
50.232.21.70:995
-
76.184.95.190:993
-
47.16.69.220:2222
-
178.169.196.115:443
-
184.64.44.21:443
-
12.172.173.82:22
-
77.126.81.208:443
-
38.69.136.177:995
-
174.104.184.149:443
-
173.18.126.3:443
-
172.90.139.138:2222
-
183.82.100.110:2222
-
184.153.132.82:443
-
86.130.9.180:2222
-
83.7.54.186:443
-
66.191.69.18:995
-
186.64.67.9:443
-
142.118.49.193:2222
-
91.254.215.167:443
-
41.34.106.203:993
-
64.228.191.212:2222
-
24.64.114.59:50010
-
80.121.50.13:443
-
216.82.134.218:443
-
92.27.86.48:2222
-
102.158.156.142:443
-
87.221.197.110:2222
-
12.172.173.82:993
-
176.142.207.63:443
-
24.64.114.59:2222
-
109.76.27.33:443
-
90.27.44.76:2222
-
92.24.200.226:995
-
75.99.125.235:2222
-
173.239.94.212:443
-
73.22.121.210:443
-
200.109.14.93:2222
-
61.92.123.169:443
-
98.145.23.67:443
-
86.190.16.164:443
-
136.35.241.159:443
-
81.155.30.185:2222
-
91.169.12.198:32100
-
71.199.168.185:443
-
64.121.161.102:443
-
37.14.229.220:2222
-
12.172.173.82:995
-
94.63.65.146:443
-
190.39.199.51:443
-
103.141.50.117:995
-
38.166.100.147:2087
-
190.28.111.166:443
-
80.107.151.232:2222
-
69.119.123.159:2222
-
213.91.235.146:443
-
76.80.180.154:995
-
130.43.99.103:995
-
12.172.173.82:465
-
75.143.236.149:443
-
92.239.81.124:443
-
74.92.243.113:50000
-
109.145.40.125:443
-
75.98.154.19:443
-
88.126.94.4:50000
-
177.205.67.80:2222
-
121.122.99.223:995
-
66.180.226.117:2222
-
78.69.251.252:2222
-
105.99.88.96:443
-
92.189.214.236:2222
-
108.162.6.34:443
-
84.35.26.14:995
-
12.172.173.82:990
-
188.54.99.243:995
-
71.31.101.183:443
-
80.13.179.151:2222
-
90.119.197.132:2222
-
47.41.154.250:443
-
109.149.148.184:2222
-
82.9.210.36:443
-
75.161.233.194:995
-
81.229.117.95:2222
-
90.116.219.167:2222
-
90.162.45.154:2222
-
190.74.104.149:465
-
76.100.159.250:443
-
105.108.215.158:990
-
197.0.145.209:443
-
70.115.104.126:995
-
50.90.249.161:443
-
109.11.175.42:2222
-
119.82.121.63:443
-
80.0.74.165:443
-
24.64.114.59:3389
-
178.191.21.187:995
-
70.66.199.12:443
-
216.196.245.102:2083
-
82.36.36.76:443
-
71.247.10.63:995
-
184.155.91.69:443
-
201.208.139.250:2222
-
12.172.173.82:21
-
199.83.165.233:443
-
90.104.22.28:2222
-
184.176.154.83:995
-
92.207.132.174:2222
-
92.185.204.18:2078
-
69.133.162.35:443
-
2.99.47.198:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cmd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 rundll32.exe 1632 rundll32.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe 460 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1632 rundll32.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4360 wrote to memory of 3700 4360 cmd.exe 78 PID 4360 wrote to memory of 3700 4360 cmd.exe 78 PID 4360 wrote to memory of 3700 4360 cmd.exe 78 PID 3700 wrote to memory of 712 3700 cmd.exe 79 PID 3700 wrote to memory of 712 3700 cmd.exe 79 PID 3700 wrote to memory of 712 3700 cmd.exe 79 PID 712 wrote to memory of 4752 712 cmd.exe 81 PID 712 wrote to memory of 4752 712 cmd.exe 81 PID 712 wrote to memory of 4752 712 cmd.exe 81 PID 712 wrote to memory of 1632 712 cmd.exe 82 PID 712 wrote to memory of 1632 712 cmd.exe 82 PID 712 wrote to memory of 1632 712 cmd.exe 82 PID 1632 wrote to memory of 460 1632 rundll32.exe 88 PID 1632 wrote to memory of 460 1632 rundll32.exe 88 PID 1632 wrote to memory of 460 1632 rundll32.exe 88 PID 1632 wrote to memory of 460 1632 rundll32.exe 88 PID 1632 wrote to memory of 460 1632 rundll32.exe 88
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CX.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /q /c glasses\caitiff.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K glasses\certificated.cmd system rundl3⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\replace.exereplace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A4⤵PID:4752
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 glasses\\astrophysics.tmp,DrawThemeIcon4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:460
-
-
-
-