Analysis
-
max time kernel
39s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-10-2021 14:24
Static task
static1
Behavioral task
behavioral1
Sample
44481.6902336806.dat.dll
Resource
win7v20210408
General
-
Target
44481.6902336806.dat.dll
-
Size
756KB
-
MD5
acdcd26de7e78893c0b6861316721469
-
SHA1
2f8716ea8f2747f7fdac054ec58644d6a3a175a4
-
SHA256
e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
-
SHA512
84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
Malware Config
Extracted
qakbot
402.363
obama113
1634023197
73.52.50.32:443
167.248.117.81:443
209.236.35.178:443
67.230.44.194:443
72.173.78.211:443
146.66.238.74:443
181.118.183.94:443
94.200.181.154:443
81.250.153.227:2222
69.30.186.190:443
93.48.58.123:2222
136.232.34.70:443
103.142.10.177:443
185.250.148.74:443
174.54.193.186:443
39.49.64.244:995
89.137.52.44:443
77.31.162.93:443
24.107.165.50:443
73.230.205.91:443
140.82.49.12:443
197.89.12.119:443
120.151.47.189:443
75.131.217.182:443
41.86.42.158:995
200.232.214.222:995
103.148.120.144:443
124.123.42.115:2222
67.166.233.75:443
41.228.22.180:443
122.11.222.242:2222
85.109.229.54:995
217.17.56.163:2078
216.201.162.158:443
81.241.252.59:2078
120.150.218.241:995
220.255.25.28:2222
63.143.92.99:995
76.25.142.196:443
73.151.236.31:443
173.22.178.66:443
187.250.159.104:443
37.210.152.224:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:443
67.165.206.193:993
75.66.88.33:443
47.40.196.233:2222
89.101.97.139:443
201.68.60.118:995
188.55.245.223:995
109.12.111.14:443
45.46.53.140:2222
73.77.87.137:443
66.216.193.114:443
24.229.150.54:995
2.222.167.138:443
78.105.213.151:995
84.39.194.65:995
96.57.188.174:2078
72.252.201.69:995
81.213.59.22:443
68.204.7.158:443
73.207.119.14:443
105.198.236.99:443
182.181.67.141:995
68.117.61.91:2222
80.6.192.58:443
37.117.191.19:2222
24.119.214.7:443
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
121.52.154.80:995
186.32.163.199:443
181.4.53.6:465
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
199.27.127.129:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
27.223.92.142:995
99.227.243.24:993
187.172.230.218:443
24.139.72.117:443
189.54.223.244:995
47.22.148.6:443
98.157.235.126:443
2.99.100.134:2222
182.176.180.73:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
24.55.112.61:443
66.103.170.104:2222
209.142.97.161:995
74.72.237.54:443
66.177.215.152:50010
131.191.107.34:995
75.75.179.226:443
24.171.50.5:443
49.33.237.65:443
162.210.220.137:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
189.131.221.201:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
177.94.125.59:995
73.130.180.25:443
206.47.134.234:2222
208.89.171.42:443
167.248.54.34:2222
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2616 1036 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
rundll32.exeWerFault.exepid process 1036 rundll32.exe 1036 rundll32.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2616 WerFault.exe Token: SeBackupPrivilege 2616 WerFault.exe Token: SeDebugPrivilege 2616 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 784 wrote to memory of 1036 784 rundll32.exe rundll32.exe PID 784 wrote to memory of 1036 784 rundll32.exe rundll32.exe PID 784 wrote to memory of 1036 784 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 7443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-114-0x0000000000000000-mapping.dmp
-
memory/1036-115-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/1036-117-0x0000000004620000-0x0000000004641000-memory.dmpFilesize
132KB
-
memory/1036-116-0x0000000004620000-0x0000000004641000-memory.dmpFilesize
132KB
-
memory/1036-119-0x0000000004620000-0x0000000004641000-memory.dmpFilesize
132KB
-
memory/1036-118-0x00000000043E0000-0x000000000441B000-memory.dmpFilesize
236KB