Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 12:40
Behavioral task
behavioral1
Sample
e2d66e565184b20277df3774c571ff60N.exe
Resource
win7-20240903-en
General
-
Target
e2d66e565184b20277df3774c571ff60N.exe
-
Size
5.7MB
-
MD5
e2d66e565184b20277df3774c571ff60
-
SHA1
0d57ec6dafb78d6847b6447c2008276bdbc1b287
-
SHA256
8a2d5de592dad921332a3f127164bc19823f668c520debf0debfe6d7a2a82628
-
SHA512
54b5a7426fb61d6c9180fd58e8101fed1e72501f62971eb5462b8fe43022356f8d203c06fffdf0b930c281d1a500742037cd18f0ce4ad4ccf115f0869dc5a3d1
-
SSDEEP
6144:Q4thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJy:3h3Hz9HeWFJDmV61AXuu6D
Malware Config
Extracted
qakbot
325.43
abc001
1599561498
166.62.180.194:2078
99.240.226.2:443
95.77.144.238:443
85.122.141.42:995
31.53.49.169:2222
201.216.216.245:443
209.59.87.147:443
85.186.122.190:443
45.32.155.12:443
178.193.38.188:2222
89.137.211.72:443
66.215.32.224:443
199.247.22.145:443
71.84.5.114:995
216.201.162.158:443
47.146.32.175:443
75.81.25.223:443
178.222.21.87:995
24.234.86.201:995
68.33.206.204:443
69.11.247.242:443
184.180.157.203:2222
108.185.113.12:443
154.56.64.251:443
176.202.187.129:61201
185.246.9.69:995
207.255.161.8:993
173.70.165.101:995
2.7.65.32:2222
71.126.139.251:443
36.77.151.211:443
76.111.128.194:443
71.187.170.235:443
72.28.255.159:995
207.255.161.8:32100
5.13.76.177:443
74.75.237.11:443
86.98.49.75:2078
68.14.210.246:22
94.49.68.94:995
50.104.68.223:443
50.244.112.10:995
72.204.242.138:465
46.248.48.232:995
72.209.191.27:443
50.232.172.114:443
71.182.142.63:443
108.31.15.10:995
86.163.174.7:2222
68.174.15.223:443
96.18.240.158:443
108.46.145.30:443
81.103.144.77:443
203.198.96.200:443
207.246.75.201:443
45.77.193.83:443
77.27.174.49:995
67.209.195.198:443
134.0.196.46:995
118.168.233.83:443
98.173.34.212:995
50.29.166.232:995
207.255.161.8:995
86.97.146.204:2222
217.165.164.57:2222
103.76.160.110:443
50.244.112.106:443
77.159.149.74:443
86.98.89.78:2222
47.28.131.209:443
82.210.157.185:443
47.153.115.154:995
173.81.22.215:443
188.26.178.176:2222
213.120.109.73:2222
2.42.219.242:443
72.179.13.59:443
176.223.7.75:2222
24.37.178.158:443
95.179.247.224:443
45.32.154.10:443
199.247.16.80:443
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
96.227.127.13:443
192.40.225.168:443
117.218.208.239:443
189.231.196.236:443
39.36.29.105:995
105.102.107.86:443
47.146.169.85:443
65.30.213.13:6882
209.182.122.217:443
72.204.242.138:20
89.45.107.94:443
64.121.114.87:443
75.110.250.89:995
80.195.103.146:2222
78.96.199.79:443
47.44.217.98:443
75.136.40.155:443
46.53.5.10:443
50.247.230.33:995
41.228.56.159:443
68.190.152.98:443
72.90.243.117:0
72.66.47.70:443
80.240.26.178:443
203.106.195.67:443
72.132.249.144:995
86.97.162.2:443
211.24.72.253:443
141.158.47.123:443
41.97.162.27:443
41.36.51.183:995
47.180.66.10:443
190.85.91.154:443
2.91.73.118:995
72.186.1.237:443
175.211.225.118:443
173.245.152.231:443
75.87.161.32:995
73.232.165.200:995
217.162.149.212:443
207.255.161.8:465
173.22.125.129:2222
61.3.126.55:443
208.82.44.203:443
172.78.30.215:443
59.96.59.31:443
5.193.181.221:2078
104.221.4.11:2222
200.124.231.21:443
185.19.190.81:443
24.201.79.208:2078
98.121.187.78:443
2.50.59.219:443
59.26.204.144:443
81.133.234.36:2222
58.233.220.210:443
151.73.125.102:443
197.37.111.167:993
35.134.202.234:443
84.247.55.190:443
172.91.19.192:443
188.214.223.150:995
47.138.201.136:443
47.185.140.236:80
117.199.2.176:443
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exePING.EXEe2d66e565184b20277df3774c571ff60N.exee2d66e565184b20277df3774c571ff60N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2d66e565184b20277df3774c571ff60N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2d66e565184b20277df3774c571ff60N.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid process 2752 cmd.exe 2896 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
e2d66e565184b20277df3774c571ff60N.exee2d66e565184b20277df3774c571ff60N.exepid process 1092 e2d66e565184b20277df3774c571ff60N.exe 2324 e2d66e565184b20277df3774c571ff60N.exe 2324 e2d66e565184b20277df3774c571ff60N.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e2d66e565184b20277df3774c571ff60N.execmd.exedescription pid process target process PID 1092 wrote to memory of 2324 1092 e2d66e565184b20277df3774c571ff60N.exe e2d66e565184b20277df3774c571ff60N.exe PID 1092 wrote to memory of 2324 1092 e2d66e565184b20277df3774c571ff60N.exe e2d66e565184b20277df3774c571ff60N.exe PID 1092 wrote to memory of 2324 1092 e2d66e565184b20277df3774c571ff60N.exe e2d66e565184b20277df3774c571ff60N.exe PID 1092 wrote to memory of 2324 1092 e2d66e565184b20277df3774c571ff60N.exe e2d66e565184b20277df3774c571ff60N.exe PID 1092 wrote to memory of 2752 1092 e2d66e565184b20277df3774c571ff60N.exe cmd.exe PID 1092 wrote to memory of 2752 1092 e2d66e565184b20277df3774c571ff60N.exe cmd.exe PID 1092 wrote to memory of 2752 1092 e2d66e565184b20277df3774c571ff60N.exe cmd.exe PID 1092 wrote to memory of 2752 1092 e2d66e565184b20277df3774c571ff60N.exe cmd.exe PID 2752 wrote to memory of 2896 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2896 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2896 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2896 2752 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2d66e565184b20277df3774c571ff60N.exe"C:\Users\Admin\AppData\Local\Temp\e2d66e565184b20277df3774c571ff60N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\e2d66e565184b20277df3774c571ff60N.exeC:\Users\Admin\AppData\Local\Temp\e2d66e565184b20277df3774c571ff60N.exe /C2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\e2d66e565184b20277df3774c571ff60N.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2896
-
-