Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe
Resource
win7-20240221-en
General
-
Target
98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe
-
Size
1.0MB
-
MD5
edd6483f2fd1816c6033204f1867b1d0
-
SHA1
3771e01d917edadf6d22871a0b00dff99f1b1cb9
-
SHA256
98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2
-
SHA512
062231bc1d9172df758e2c89e7e1d91c22daa916d685830806c73559a1a58e2a0658e5413c0e183994bc5a6f1df3a6077a8e990a2bd7565a659d4cf693c90f72
-
SSDEEP
12288:KVbaHbD19/nXEx5xuzi6AoS5qt4cW+EEFsfZdGvvOWTbH:KZ+bh9cTottW+jKZI3OWTL
Malware Config
Extracted
qakbot
325.43
abc004
1600240826
96.227.127.13:443
98.22.65.76:443
67.165.206.193:993
50.244.112.10:995
72.204.242.138:465
72.36.59.46:2222
68.174.15.223:443
69.11.247.242:443
75.81.25.223:443
95.77.223.148:443
47.146.32.175:443
50.232.172.114:443
24.231.54.185:2222
184.180.157.203:2222
190.31.192.182:443
84.47.220.117:995
96.18.240.158:443
117.199.14.80:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
173.26.189.151:443
2.90.44.121:995
78.96.199.79:443
156.213.179.139:443
84.232.238.30:443
213.31.203.48:2222
36.77.151.211:443
71.187.170.235:443
24.218.181.15:443
199.247.22.145:443
207.255.161.8:32100
207.255.161.8:2078
96.41.93.96:443
188.51.33.232:995
50.244.112.106:443
24.37.178.158:443
47.28.131.209:443
141.158.47.123:443
72.204.242.138:990
41.228.203.53:443
72.179.13.59:443
186.94.5.67:2078
175.211.225.118:443
178.222.113.168:995
50.104.68.223:443
98.16.204.189:995
189.231.196.236:443
67.209.195.198:443
80.14.209.42:2222
84.117.176.32:443
207.255.161.8:995
2.7.65.32:2222
120.150.60.189:995
73.228.1.246:443
209.137.209.163:995
185.246.9.69:995
45.32.154.10:443
24.205.42.241:443
199.247.16.80:443
207.246.75.201:443
45.77.193.83:443
72.190.101.70:443
80.195.103.146:2222
188.24.196.245:995
2.91.109.154:995
188.247.252.243:443
203.198.96.200:443
67.170.137.8:443
47.138.201.136:443
144.139.47.206:443
31.5.21.66:443
96.30.198.161:443
95.179.247.224:443
117.218.208.239:443
92.59.35.196:2222
24.210.45.215:443
98.26.50.62:995
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
5.12.0.239:443
74.75.216.202:443
173.22.125.129:2222
86.98.89.62:2222
39.36.105.140:995
65.131.34.101:995
84.78.128.76:2222
2.90.109.29:995
24.53.49.240:2222
51.223.158.125:443
217.165.164.132:2222
72.209.191.27:443
189.183.73.227:995
47.44.217.98:443
84.247.55.190:443
71.221.92.98:443
103.76.160.110:443
47.146.169.85:443
80.240.26.178:443
67.60.113.253:2222
75.87.161.32:995
66.222.88.126:995
24.201.79.208:2078
24.234.86.201:995
47.147.11.28:443
65.30.213.13:6882
95.76.109.181:443
24.40.173.134:443
75.136.40.155:443
134.0.196.46:995
5.12.194.114:2222
2.50.59.219:443
172.78.30.215:443
190.85.91.154:443
5.193.181.221:2078
75.182.214.87:443
73.200.219.143:443
63.155.74.135:995
68.13.99.24:443
173.81.22.215:443
98.121.187.78:443
187.206.64.235:995
83.110.6.64:2222
103.206.112.234:443
216.201.162.158:443
37.210.186.213:61201
69.123.179.70:443
71.126.139.251:443
71.84.5.114:995
59.26.204.144:443
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
166.62.180.194:2078
108.185.113.12:443
216.163.4.136:443
66.215.32.224:443
71.220.200.82:2222
35.134.202.234:443
117.215.198.3:443
72.204.242.138:32102
77.159.149.74:443
207.255.161.8:465
200.75.136.78:443
45.46.53.140:2222
202.141.244.118:995
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3012 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 1156 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 1156 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 1156 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 1156 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1156 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 96 PID 1048 wrote to memory of 1156 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 96 PID 1048 wrote to memory of 1156 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 96 PID 1048 wrote to memory of 3612 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 97 PID 1048 wrote to memory of 3612 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 97 PID 1048 wrote to memory of 3612 1048 98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe 97 PID 3612 wrote to memory of 3012 3612 cmd.exe 99 PID 3612 wrote to memory of 3012 3612 cmd.exe 99 PID 3612 wrote to memory of 3012 3612 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe"C:\Users\Admin\AppData\Local\Temp\98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exeC:\Users\Admin\AppData\Local\Temp\98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe /C2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1156
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\98cda311879120391aca6e5e7b01e938e135013c53c43ae85cf594cd15eda9d2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- Runs ping.exe
PID:3012
-
-