Analysis
-
max time kernel
33s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2023 12:45
Behavioral task
behavioral1
Sample
972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe
Resource
win7-20230712-en
General
-
Target
972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe
-
Size
2.6MB
-
MD5
287639ea8e2d67e00862c39eebc47882
-
SHA1
0273a2a84becb04a7cbadf323d538d94a6031961
-
SHA256
972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d
-
SHA512
da502a8f63d088b51a6115141e3d5348e00dc8de09b57211e66b424edbeb95ba40967efc14dc694cff6b51073690fa250ec2ddc25bfcf5dd86d66051fea39901
-
SSDEEP
12288:FlQ42wwLHqpVxTXLqVrytXS/eAYkfgn6ggK:L2wwTEmy5Sm3kfg93
Malware Config
Extracted
qakbot
324.142
notset
1590741916
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
[email protected] - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
[email protected] - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
[email protected] - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
[email protected] - Password:
eQyicNLzzqPN
108.227.161.27:995
173.187.103.35:443
117.216.185.86:443
24.43.22.220:443
72.190.101.70:443
207.255.161.8:2087
189.160.217.221:443
207.255.161.8:32102
24.226.137.154:443
66.222.88.126:995
108.58.9.238:995
1.40.42.4:443
47.152.210.233:443
72.45.14.185:443
82.127.193.151:2222
101.108.113.6:443
175.111.128.234:995
175.111.128.234:443
47.39.76.74:443
5.12.214.109:2222
24.218.181.15:443
216.201.162.158:995
108.21.107.203:443
107.2.148.99:443
189.236.218.181:443
120.57.74.208:443
75.110.250.89:443
211.24.72.253:443
207.255.161.8:443
50.104.186.71:443
100.38.123.22:443
96.18.240.158:443
173.187.170.190:443
100.40.48.96:443
71.80.66.107:443
67.197.97.144:443
69.28.222.54:443
95.77.223.148:443
47.136.224.60:443
47.202.98.230:443
184.180.157.203:2222
104.221.4.11:2222
70.173.46.139:443
213.67.45.195:2222
46.214.62.199:443
67.131.59.17:443
154.56.69.172:443
72.16.212.108:465
98.121.187.78:443
217.162.149.212:443
74.33.70.245:443
89.47.223.207:443
188.26.243.186:443
72.177.157.217:443
72.29.181.77:2078
203.106.195.139:443
98.114.185.3:443
71.187.170.235:443
71.185.60.227:443
68.204.164.222:443
76.170.77.99:443
37.41.53.184:443
140.82.21.191:443
68.46.142.48:443
98.16.204.189:995
50.244.112.10:443
27.212.0.173:995
62.121.123.57:443
103.76.160.110:443
117.199.4.78:443
63.230.11.201:2083
95.76.6.106:995
67.182.16.216:32103
186.144.174.237:443
47.41.3.40:443
74.75.216.202:443
188.212.133.31:443
31.5.21.66:443
84.117.176.32:443
178.222.29.131:995
81.133.234.36:2222
71.220.172.127:2222
50.29.166.232:995
24.55.152.50:995
75.183.171.155:3389
78.188.109.130:443
58.233.220.182:443
78.97.119.189:443
71.77.231.251:443
73.226.220.56:443
68.174.15.223:443
70.183.127.6:995
59.26.204.210:443
5.107.213.220:2222
173.79.220.156:443
70.174.3.241:443
203.33.139.134:443
71.79.144.56:443
76.187.8.160:443
187.155.66.12:443
117.216.224.103:443
96.56.237.174:32103
79.116.68.99:2222
98.243.187.85:443
75.142.59.167:443
80.14.209.42:2222
120.29.124.86:443
73.121.132.5:443
73.94.229.115:443
108.51.73.186:443
50.247.230.33:995
96.56.237.174:993
50.78.93.74:443
50.244.112.106:443
45.77.215.141:443
66.68.22.151:443
144.202.48.107:443
207.246.71.122:443
201.211.6.211:2078
96.35.170.82:2222
67.170.137.8:443
108.185.113.12:443
98.32.60.217:443
207.255.161.8:2078
86.126.97.183:2222
108.27.217.44:443
207.255.161.8:32103
49.191.130.142:443
137.99.224.198:443
80.184.91.6:443
47.232.26.181:443
72.36.59.46:2222
96.56.237.174:990
207.255.161.8:995
24.43.22.220:993
94.10.81.239:443
94.52.160.116:443
67.0.74.119:443
175.137.136.79:443
73.232.165.200:995
79.119.67.149:443
62.38.111.70:2222
108.58.9.238:993
216.110.249.252:2222
67.209.195.198:3389
84.247.55.190:443
96.37.137.42:443
94.176.220.76:2222
173.245.152.231:443
96.227.122.123:443
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5056 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 2228 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 2228 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 2228 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 2228 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 716 wrote to memory of 2228 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 89 PID 716 wrote to memory of 2228 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 89 PID 716 wrote to memory of 2228 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 89 PID 716 wrote to memory of 2100 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 91 PID 716 wrote to memory of 2100 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 91 PID 716 wrote to memory of 2100 716 972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe 91 PID 2100 wrote to memory of 5056 2100 cmd.exe 93 PID 2100 wrote to memory of 5056 2100 cmd.exe 93 PID 2100 wrote to memory of 5056 2100 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe"C:\Users\Admin\AppData\Local\Temp\972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exeC:\Users\Admin\AppData\Local\Temp\972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2228
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\972582ceac5ed19fc07fb72847d9e73b218aa2b3882137e245df59c0e3de587d_similar.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
PID:5056
-
-