Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
29/09/2023, 07:01
Behavioral task
behavioral1
Sample
ioenou.exe
Resource
win7-20230831-en
windows7-x64
General
-
Target
ioenou.exe
-
Size
130KB
-
MD5
479c596e0459402209859913aa4280ed
-
SHA1
3786faae5946919d23631bb69c8b6a07d5775abf
-
SHA256
28f49c8ec7e739247dc8fbaa421456efb5869b1d92181d2b99c93520064cbb5f
-
SHA512
0475695a4f8933b6afdf73eb3546fba4edcc47ad01f9dc9af2910a07fb89101bd2288fa91702b95d8c4a06abbbc4fe38a3b12abbc6f622a00d4c2400c9dac9ff
-
SSDEEP
3072:608q9D1i4yfNwvcKgi1AvuJ4I/YzTBfQzcoG5y:cfiEKxGvuJL/YzTBozcoG5y
Malware Config
Extracted
qakbot
404.1377
snow09
1686740620
101.184.155.156:2222
89.79.229.50:443
173.17.45.60:443
124.246.122.199:2222
84.215.202.8:443
122.184.143.86:443
79.168.224.165:2222
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
64.121.161.102:443
187.199.244.117:32103
91.68.227.219:443
176.142.207.63:443
47.199.241.39:443
89.129.109.27:2222
67.87.119.216:2078
98.4.43.111:443
200.93.25.6:2222
142.188.88.42:2222
86.128.15.251:2222
201.244.108.183:995
74.12.146.45:2083
151.65.167.77:443
41.228.224.205:995
86.129.138.170:443
113.11.92.30:443
12.172.173.82:2087
72.205.104.134:443
84.213.236.225:995
92.186.69.229:2222
1.221.179.74:443
103.141.50.43:995
58.162.223.233:443
96.242.126.116:2222
51.11.214.101:2222
75.109.111.89:443
125.99.76.102:443
80.12.88.148:2222
109.149.147.195:2222
27.99.32.26:2222
70.28.50.223:3389
70.28.50.223:32100
86.97.96.62:2222
66.241.183.99:443
74.12.146.45:2222
190.199.147.209:2222
47.205.25.170:443
12.172.173.82:993
12.172.173.82:22
84.35.26.14:995
72.134.124.16:443
85.240.173.251:2078
50.68.186.195:443
65.190.242.244:443
45.62.75.217:443
203.109.44.236:995
174.58.146.57:443
105.184.159.9:995
94.207.115.105:443
197.0.146.211:443
197.204.11.218:443
92.9.45.20:2222
91.169.12.198:32100
12.172.173.82:20
70.64.77.115:443
71.31.9.49:995
24.234.220.88:990
95.45.50.93:2222
213.91.235.146:443
189.223.184.79:443
213.64.33.92:2222
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
67.219.197.94:443
103.140.174.20:2222
12.172.173.82:995
90.29.86.138:2222
37.14.229.220:2222
89.181.227.42:2222
62.35.230.21:995
70.160.67.203:443
88.126.94.4:50000
203.219.204.180:443
147.219.4.194:443
92.20.204.198:2222
24.234.220.88:993
188.28.19.84:443
89.115.200.234:443
67.87.119.216:2083
86.98.222.20:443
161.142.100.114:995
103.139.242.6:443
103.123.223.153:443
24.234.220.88:995
102.158.231.164:443
175.156.65.126:2222
41.227.190.59:443
178.175.187.254:443
180.151.13.23:2078
12.172.173.82:50001
116.75.63.143:443
78.192.109.105:2222
37.186.55.8:2222
121.121.100.202:995
104.35.24.154:443
199.27.66.213:443
181.165.19.254:443
81.229.117.95:2222
12.172.173.82:21
45.2.61.134:3389
162.248.14.107:443
103.212.19.254:995
2.82.8.80:443
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 ioenou.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe 2128 wermgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28 PID 2044 wrote to memory of 2128 2044 ioenou.exe 28