Analysis
- max time kernel
4294210s - max time network
120s - platform
windows7_x64 - resource
win7-20220311-en - submitted
22/03/2022, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll
Resource
win7-20220311-en
windows7_x64
General
- Target 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll
- Size 511KB
- Sample220322-p2x8rafba7
- SHA256 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e
- MD5 7531aa8c3508046d1f17de8087915332
- SHA1 957b8cd7babadf9d5104fb11e7508def071e08a9
- SHA512 d8c23a425d807c78304b2192c845d81d89dcf7981871d660bb824ce7a7591101166d22bf5a71253800ba074e83a347a56f9458881a4dbd7e3659f48be2930dcd
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.549
-
obama168
-
1647853291
-
103.87.95.131:2222
-
195.32.57.18:80
-
92.99.229.158:2222
-
40.134.246.185:995
-
31.215.118.154:1194
-
41.228.22.180:443
-
39.49.39.239:995
-
217.128.122.65:2222
-
86.98.27.253:443
-
82.152.39.39:443
-
197.0.103.214:443
-
76.169.147.192:32103
-
24.152.219.253:995
-
37.186.54.166:995
-
202.134.152.2:2222
-
177.134.208.155:993
-
45.239.129.13:443
-
1.161.76.70:995
-
120.150.218.241:995
-
79.52.204.9:50001
-
74.15.2.252:2222
-
206.217.0.154:995
-
209.180.70.25:443
-
2.34.12.8:443
-
175.145.235.37:443
-
39.44.151.33:995
-
120.61.0.6:443
-
190.73.3.148:2222
-
76.70.9.169:2222
-
76.69.155.202:2222
-
217.165.109.52:993
-
161.142.56.8:443
-
31.215.69.127:443
-
5.95.58.211:2087
-
130.164.149.84:443
-
75.99.168.194:443
-
96.21.251.127:2222
-
140.82.49.12:443
-
124.41.193.166:443
-
80.11.74.81:2222
-
108.60.213.141:443
-
176.67.56.94:443
-
37.152.80.105:443
-
196.203.37.215:80
-
148.64.96.100:443
-
197.162.109.164:995
-
102.140.71.40:443
-
47.180.172.159:443
-
91.177.173.10:995
-
217.165.79.31:443
-
182.191.92.203:995
-
31.35.28.29:443
-
24.43.99.75:443
-
5.32.41.45:443
-
103.88.226.82:443
-
86.195.158.178:2222
-
93.48.80.198:995
-
47.180.172.159:50010
-
75.99.168.194:61201
-
45.9.20.200:443
-
173.174.216.62:443
-
47.23.89.62:993
-
197.167.5.180:993
-
144.202.2.175:995
-
140.82.63.183:995
-
144.202.3.39:443
-
149.28.238.199:443
-
45.76.167.26:443
-
140.82.63.183:443
-
45.76.167.26:995
-
45.63.1.12:995
-
149.28.238.199:995
-
144.202.2.175:443
-
144.202.3.39:995
-
45.63.1.12:443
-
207.170.238.231:443
-
197.92.138.54:443
-
71.13.93.154:2222
-
32.221.225.247:995
-
69.159.200.138:2222
-
37.210.149.61:2222
-
180.233.150.134:995
-
186.10.247.110:443
-
113.11.89.170:995
-
188.50.49.149:995
-
141.237.95.186:995
-
217.165.79.31:995
-
92.177.45.46:2078
-
106.51.48.170:50001
-
47.23.89.62:995
-
70.57.207.83:443
-
31.215.118.154:2222
-
172.115.177.204:2222
-
110.143.139.163:443
-
72.76.94.99:443
-
70.46.220.114:443
-
24.178.196.158:2222
-
67.209.195.198:443
-
121.74.182.236:995
-
75.159.9.236:443
-
172.114.160.81:995
-
78.188.76.167:443
-
1.161.76.70:443
-
2.42.176.91:443
-
76.23.237.163:995
-
128.106.123.187:443
-
103.157.122.130:21
-
67.165.206.193:993
-
39.52.66.201:995
-
191.99.191.28:443
-
174.69.215.101:443
-
76.25.142.196:443
-
173.21.10.71:2222
-
71.74.12.34:443
-
189.146.51.56:443
-
208.107.221.224:443
-
143.0.34.185:443
-
73.151.236.31:443
-
82.41.63.217:443
-
73.59.201.174:443
-
109.12.111.14:443
-
45.46.53.140:2222
-
89.101.97.139:443
-
86.198.170.170:2222
-
38.70.253.226:2222
-
41.84.240.210:995
-
86.98.150.187:995
-
86.180.31.38:443
-
103.230.180.119:443
-
89.137.52.44:443
-
197.37.7.47:995
-
75.188.35.168:443
-
187.199.203.159:443
-
72.12.115.90:22
-
189.237.6.251:443
-
201.172.31.135:2222
-
201.170.181.247:443
-
105.184.195.104:995
-
177.134.208.155:995
-
125.25.133.221:443
-
114.79.148.170:443
-
180.129.97.57:995
-
58.105.167.35:50000
-
201.145.160.158:443
-
201.103.6.221:443
-
47.156.191.217:443
-
70.51.135.39:2222
-
63.143.92.99:995
-
86.105.44.249:61202
-
100.1.108.246:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1040 regsvr32.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe 2032 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1040 regsvr32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1760 wrote to memory of 1040 1760 regsvr32.exe 27 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28 PID 1040 wrote to memory of 2032 1040 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-