Analysis
-
max time kernel
138s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 01:08
Behavioral task
behavioral1
Sample
136b9c85525ba66276b8c9f6b7014b0b.exe
Resource
win7-20230831-en
General
-
Target
136b9c85525ba66276b8c9f6b7014b0b.exe
-
Size
1.2MB
-
MD5
136b9c85525ba66276b8c9f6b7014b0b
-
SHA1
0cf5ba13d14c28c60586c7f4b9679925fa4d4172
-
SHA256
a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
-
SHA512
0c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590
-
SSDEEP
6144:JanAo3boaSrTBRc6nWF84LvSkgNSjEtIovH6DgJG3uhRtSUgnSt9BYbC38g/T4J:JaAKoRrTBHWC4LINSjA/EMGU/SHomaI
Malware Config
Extracted
qakbot
324.142
spx133
1591267427
49.144.84.21:443
189.159.133.162:995
173.245.152.231:443
77.237.181.212:995
207.255.161.8:2078
76.187.8.160:443
207.255.161.8:2087
98.219.77.197:443
66.222.88.126:995
207.255.161.8:32102
108.58.9.238:995
47.152.210.233:443
1.40.42.4:443
188.27.71.163:443
82.127.193.151:2222
104.50.141.139:995
67.83.54.76:2222
86.126.97.183:2222
73.94.229.115:443
47.35.182.97:443
72.29.181.77:2078
98.114.185.3:443
24.226.137.154:443
5.12.114.96:443
78.97.145.242:443
64.121.114.87:443
62.121.123.57:443
151.73.126.205:443
69.40.17.142:443
197.165.178.49:443
80.240.26.178:443
79.115.128.221:443
49.191.4.245:443
71.187.170.235:443
108.51.73.186:443
134.0.196.46:995
75.81.25.223:443
96.56.237.174:993
72.240.245.253:443
67.131.59.17:443
216.163.4.91:443
72.204.242.138:443
72.190.101.70:443
47.201.1.210:443
24.43.22.220:995
76.170.77.99:443
71.163.225.75:443
69.92.54.95:995
108.31.92.113:443
185.246.9.69:995
79.119.67.149:443
47.205.231.60:443
66.26.160.37:443
65.131.83.170:995
47.40.244.237:443
71.77.231.251:443
50.244.112.106:443
96.41.93.96:443
47.153.115.154:995
62.38.111.70:2222
72.16.212.108:465
24.46.40.189:2222
24.10.42.174:443
85.121.42.12:995
188.192.75.8:443
174.34.67.106:2222
70.174.3.241:443
65.24.76.114:443
128.234.46.27:443
100.38.123.22:443
67.5.28.72:465
96.18.240.158:443
85.186.141.62:995
207.255.18.67:443
207.255.161.8:2222
79.113.219.121:443
203.33.139.134:443
72.209.191.27:443
64.19.74.29:995
24.201.79.208:2078
98.115.138.61:443
68.174.15.223:443
75.87.161.32:995
50.244.112.10:443
173.175.29.210:443
173.22.120.11:2222
74.215.201.122:443
76.15.41.32:443
176.193.41.32:2222
50.29.181.193:995
207.255.161.8:32103
24.152.219.253:995
72.204.242.138:2078
173.187.169.73:443
24.43.22.220:443
71.88.104.107:995
89.44.195.186:2222
93.113.90.128:443
5.13.99.38:995
72.183.129.56:443
86.123.106.54:443
5.14.251.226:443
69.245.144.167:443
82.76.239.193:443
81.103.144.77:443
70.183.127.6:995
24.99.180.247:443
175.111.128.234:443
50.247.230.33:995
2.88.183.192:443
24.42.14.241:443
98.118.156.172:443
216.201.162.158:995
81.133.234.36:2222
173.172.205.216:443
184.98.104.7:995
47.146.169.85:443
108.27.217.44:443
74.56.167.31:443
80.195.103.146:2222
67.209.195.198:3389
96.37.137.42:443
108.58.9.238:993
173.79.220.156:443
98.32.60.217:443
78.96.192.26:443
79.117.161.67:21
72.28.255.159:995
207.162.184.228:443
189.140.112.184:443
105.184.48.142:443
97.93.211.17:443
47.153.115.154:443
188.192.75.8:995
142.129.227.86:443
72.69.180.183:61202
75.183.171.155:3389
140.82.21.191:443
71.185.60.227:443
137.103.143.124:443
173.49.122.160:995
96.35.170.82:2222
71.80.66.107:443
59.124.10.133:443
69.28.222.54:443
47.136.224.60:443
184.180.157.203:2222
72.177.157.217:995
104.221.4.11:2222
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Mszao\ehidxs.exe cryptone -
Drops startup file 1 IoCs
Processes:
136b9c85525ba66276b8c9f6b7014b0b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ehidxs.lnk 136b9c85525ba66276b8c9f6b7014b0b.exe -
Loads dropped DLL 1 IoCs
Processes:
136b9c85525ba66276b8c9f6b7014b0b.exepid process 2468 136b9c85525ba66276b8c9f6b7014b0b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
136b9c85525ba66276b8c9f6b7014b0b.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 136b9c85525ba66276b8c9f6b7014b0b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 136b9c85525ba66276b8c9f6b7014b0b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 136b9c85525ba66276b8c9f6b7014b0b.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
136b9c85525ba66276b8c9f6b7014b0b.exe136b9c85525ba66276b8c9f6b7014b0b.exe136b9c85525ba66276b8c9f6b7014b0b.exepid process 2468 136b9c85525ba66276b8c9f6b7014b0b.exe 2176 136b9c85525ba66276b8c9f6b7014b0b.exe 2176 136b9c85525ba66276b8c9f6b7014b0b.exe 1040 136b9c85525ba66276b8c9f6b7014b0b.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
136b9c85525ba66276b8c9f6b7014b0b.exetaskeng.exe136b9c85525ba66276b8c9f6b7014b0b.execmd.exedescription pid process target process PID 2468 wrote to memory of 2176 2468 136b9c85525ba66276b8c9f6b7014b0b.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2468 wrote to memory of 2176 2468 136b9c85525ba66276b8c9f6b7014b0b.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2468 wrote to memory of 2176 2468 136b9c85525ba66276b8c9f6b7014b0b.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2468 wrote to memory of 2176 2468 136b9c85525ba66276b8c9f6b7014b0b.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2468 wrote to memory of 2824 2468 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 2468 wrote to memory of 2824 2468 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 2468 wrote to memory of 2824 2468 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 2468 wrote to memory of 2824 2468 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 2872 wrote to memory of 1040 2872 taskeng.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2872 wrote to memory of 1040 2872 taskeng.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2872 wrote to memory of 1040 2872 taskeng.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 2872 wrote to memory of 1040 2872 taskeng.exe 136b9c85525ba66276b8c9f6b7014b0b.exe PID 1040 wrote to memory of 2488 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2488 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2488 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2488 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2544 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2544 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2544 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2544 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1808 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1808 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1808 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1808 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 3028 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 3028 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 3028 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 3028 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1812 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1812 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1812 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1812 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2472 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2472 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2472 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2472 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1676 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1676 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1676 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 1676 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2840 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2840 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2840 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2840 1040 136b9c85525ba66276b8c9f6b7014b0b.exe reg.exe PID 1040 wrote to memory of 2880 1040 136b9c85525ba66276b8c9f6b7014b0b.exe cmd.exe PID 1040 wrote to memory of 2880 1040 136b9c85525ba66276b8c9f6b7014b0b.exe cmd.exe PID 1040 wrote to memory of 2880 1040 136b9c85525ba66276b8c9f6b7014b0b.exe cmd.exe PID 1040 wrote to memory of 2880 1040 136b9c85525ba66276b8c9f6b7014b0b.exe cmd.exe PID 1040 wrote to memory of 2892 1040 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 1040 wrote to memory of 2892 1040 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 1040 wrote to memory of 2892 1040 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 1040 wrote to memory of 2892 1040 136b9c85525ba66276b8c9f6b7014b0b.exe schtasks.exe PID 2880 wrote to memory of 1992 2880 cmd.exe PING.EXE PID 2880 wrote to memory of 1992 2880 cmd.exe PING.EXE PID 2880 wrote to memory of 1992 2880 cmd.exe PING.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe"C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exeC:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cyugzkaykx /tr "\"C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe\" /I cyugzkaykx" /SC ONCE /Z /ST 01:11 /ET 01:232⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {0BE01AA6-7489-4B06-A1EB-0B2FA73E96AD} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exeC:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe /I cyugzkaykx2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\136b9c85525ba66276b8c9f6b7014b0b.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN cyugzkaykx3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Mszao\ehidxs.exeFilesize
1.2MB
MD5136b9c85525ba66276b8c9f6b7014b0b
SHA10cf5ba13d14c28c60586c7f4b9679925fa4d4172
SHA256a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
SHA5120c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590
-
memory/1040-14-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/1040-15-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2176-3-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2176-4-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2468-0-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/2468-1-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2468-2-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2468-7-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2468-9-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2468-13-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB