9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Submit
Reports

Overview

overview

Static

static

029b714502...39.dll

windows10_x64

061dfb6a25...52.dll

windows10_x64

06d55f75d7...d2.dll

windows10_x64

24401ac43b...65.dll

windows10_x64

260e2d5769...40.dll

windows10_x64

26cd036960...18.dll

windows10_x64

2a0a88a2e5...4a.dll

windows10_x64

2f33217d51...94.dll

windows10_x64

336cdd146b...da.dll

windows10_x64

417c1828d9...73.dll

windows10_x64

4d3095c796...ee.dll

windows10_x64

54e526fe05...4c.dll

windows10_x64

6402b33d72...3b.dll

windows10_x64

64c044cb3e...db.dll

windows10_x64

671f477c30...4e.dll

windows10_x64

67785724b6...ce.dll

windows10_x64

6c6934613a...fb.dll

windows10_x64

6f63742c25...fd.dll

windows10_x64

813a9b03c6...48.dll

windows10_x64

839ac59a78...e3.dll

windows10_x64

85d0b72fe8...39.dll

windows10_x64

a34cb4049e...c4.dll

windows10_x64

a55c19c552...60.dll

windows10_x64

a98e988f03...48.dll

windows10_x64

acc31f97c3...27.dll

windows10_x64

b194eec1e5...c7.dll

windows10_x64

bac73f9cce...00.dll

windows10_x64

c5d2f0da18...0c.dll

windows10_x64

d559ee0a26...7e.dll

windows10_x64

db5276c0d5...79.dll

windows10_x64

e5efde9740...15.dll

windows10_x64

fe028e6f99...1c.dll

windows10_x64

Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

max time kernel
111s
max time network
3724s
platform
windows10_x64
resource
win10-en-20210920
submitted
31-10-2021 09:03

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

029b714502283599a5efb86d41c48fd46751ab727b707bde620e517ec3aa3c39.dll

Resource

win10-en-20210920

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll

Resource

win10-en-20210920

qakbot notset 1632819510 banker stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll

Resource

win10-en-20210920

qakbot tr 1633597626 banker evasion stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll

Resource

win10-en-20211014

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll

Resource

win10-en-20210920

qakbot tr 1633334141 banker evasion stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll

Resource

win10-en-20210920

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll

Resource

win10-en-20211014

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll

Resource

win10-en-20210920

bazarbackdoor bazarloader backdoor dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll

Resource

win10-en-20211014

qakbot tr 1632730751 banker persistence stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll

Resource

win10-en-20210920

bazarloader dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll

Resource

win10-en-20211014

qakbot obama101 1632228858 banker stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll

Resource

win10-en-20210920

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll

Resource

win10-en-20211014

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll

Resource

win10-en-20210920

squirrelwaffle downloader

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll

Resource

win10-en-20210920

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll

Resource

win10-en-20211014

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll

Resource

win10-en-20210920

bazarbackdoor bazarloader backdoor dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

6f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd.dll

Resource

win10-en-20211014

qakbot tr 1632817399 banker persistence stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

813a9b03c6c1caec4eca8a867dcfbda7860bca6a5d481acb4c131c1a868d4b48.dll

Resource

win10-en-20210920

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll

Resource

win10-en-20210920

qakbot tr 1633943125 banker evasion stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

85d0b72fe822fd6c22827b4da1917d2c1f2d9faa838e003e78e533384ea80939.dll

Resource

win10-en-20211014

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll

Resource

win10-en-20210920

qakbot tr 1633597626 banker evasion persistence stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll

Resource

win10-en-20211014

bazarbackdoor bazarloader backdoor dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

a98e988f03fd5be37c66878017a3dcd741adf75bf1df1ed6dde2c15ee213bb48.dll

Resource

win10-en-20210920

qakbot obama102 1632302707 banker stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27.dll

Resource

win10-en-20211014

qakbot tr 1633597816 banker stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll

Resource

win10-en-20210920

qakbot tr 1632817399 banker evasion stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral27

Sample

bac73f9ccebf93009a6037145a9c71a2e8b916956f6a7e6a4f4b53b4b50b7a00.dll

Resource

win10-en-20210920

qakbot notset 1632819510 banker stealer trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral28

Sample

c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll

Resource

win10-en-20211014

bazarloader dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral29

Sample

d559ee0a26fa500cd57fac25d58ba4319a794f329c8711e89afac3c281f9dd7e.dll

Resource

win10-en-20210920

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral30

Sample

db5276c0d5ecd3b338a98983001a5b8cbbf5b488bf420d8cc0267801b963f479.dll

Resource

win10-en-20211014

bazarbackdoor bazarloader backdoor dropper loader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral31

Sample

e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815.dll

Resource

win10-en-20210920

squirrelwaffle downloader suricata

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral32

Sample

fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll

Resource

win10-en-20211014

bazarbackdoor bazarloader backdoor dropper loader suricata

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Size

398KB
MD5

36e57cea07affea16fa5921d348021dc
SHA1

822d62e274e51516318fea9a12a0c6237d964782
SHA256

54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c
SHA512

3bfd989132682eaf3a14f143a7d93e00ba3a2d35ead9cffd5aeb394e8d9040b679191094e0ab1c1393aa22cc2a20e59b9c0ca88bc661793ab2b02fdb92d90c54

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4276 wrote to memory of 592	4276	rundll32.exe	rundll32.exe
PID 4276 wrote to memory of 592	4276	rundll32.exe	rundll32.exe
PID 4276 wrote to memory of 592	4276	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll,#1
2⤵
PID:592

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads