Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll
Resource
win7-20220311-en
windows7_x64
General
- Target 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll
- Size 511KB
- Sample220322-p2x8rafba7
- SHA256 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e
- MD5 7531aa8c3508046d1f17de8087915332
- SHA1 957b8cd7babadf9d5104fb11e7508def071e08a9
- SHA512 d8c23a425d807c78304b2192c845d81d89dcf7981871d660bb824ce7a7591101166d22bf5a71253800ba074e83a347a56f9458881a4dbd7e3659f48be2930dcd
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.549
-
obama168
-
1647853291
-
103.87.95.131:2222
-
195.32.57.18:80
-
92.99.229.158:2222
-
40.134.246.185:995
-
31.215.118.154:1194
-
41.228.22.180:443
-
39.49.39.239:995
-
217.128.122.65:2222
-
86.98.27.253:443
-
82.152.39.39:443
-
197.0.103.214:443
-
76.169.147.192:32103
-
24.152.219.253:995
-
37.186.54.166:995
-
202.134.152.2:2222
-
177.134.208.155:993
-
45.239.129.13:443
-
1.161.76.70:995
-
120.150.218.241:995
-
79.52.204.9:50001
-
74.15.2.252:2222
-
206.217.0.154:995
-
209.180.70.25:443
-
2.34.12.8:443
-
175.145.235.37:443
-
39.44.151.33:995
-
120.61.0.6:443
-
190.73.3.148:2222
-
76.70.9.169:2222
-
76.69.155.202:2222
-
217.165.109.52:993
-
161.142.56.8:443
-
31.215.69.127:443
-
5.95.58.211:2087
-
130.164.149.84:443
-
75.99.168.194:443
-
96.21.251.127:2222
-
140.82.49.12:443
-
124.41.193.166:443
-
80.11.74.81:2222
-
108.60.213.141:443
-
176.67.56.94:443
-
37.152.80.105:443
-
196.203.37.215:80
-
148.64.96.100:443
-
197.162.109.164:995
-
102.140.71.40:443
-
47.180.172.159:443
-
91.177.173.10:995
-
217.165.79.31:443
-
182.191.92.203:995
-
31.35.28.29:443
-
24.43.99.75:443
-
5.32.41.45:443
-
103.88.226.82:443
-
86.195.158.178:2222
-
93.48.80.198:995
-
47.180.172.159:50010
-
75.99.168.194:61201
-
45.9.20.200:443
-
173.174.216.62:443
-
47.23.89.62:993
-
197.167.5.180:993
-
144.202.2.175:995
-
140.82.63.183:995
-
144.202.3.39:443
-
149.28.238.199:443
-
45.76.167.26:443
-
140.82.63.183:443
-
45.76.167.26:995
-
45.63.1.12:995
-
149.28.238.199:995
-
144.202.2.175:443
-
144.202.3.39:995
-
45.63.1.12:443
-
207.170.238.231:443
-
197.92.138.54:443
-
71.13.93.154:2222
-
32.221.225.247:995
-
69.159.200.138:2222
-
37.210.149.61:2222
-
180.233.150.134:995
-
186.10.247.110:443
-
113.11.89.170:995
-
188.50.49.149:995
-
141.237.95.186:995
-
217.165.79.31:995
-
92.177.45.46:2078
-
106.51.48.170:50001
-
47.23.89.62:995
-
70.57.207.83:443
-
31.215.118.154:2222
-
172.115.177.204:2222
-
110.143.139.163:443
-
72.76.94.99:443
-
70.46.220.114:443
-
24.178.196.158:2222
-
67.209.195.198:443
-
121.74.182.236:995
-
75.159.9.236:443
-
172.114.160.81:995
-
78.188.76.167:443
-
1.161.76.70:443
-
2.42.176.91:443
-
76.23.237.163:995
-
128.106.123.187:443
-
103.157.122.130:21
-
67.165.206.193:993
-
39.52.66.201:995
-
191.99.191.28:443
-
174.69.215.101:443
-
76.25.142.196:443
-
173.21.10.71:2222
-
71.74.12.34:443
-
189.146.51.56:443
-
208.107.221.224:443
-
143.0.34.185:443
-
73.151.236.31:443
-
82.41.63.217:443
-
73.59.201.174:443
-
109.12.111.14:443
-
45.46.53.140:2222
-
89.101.97.139:443
-
86.198.170.170:2222
-
38.70.253.226:2222
-
41.84.240.210:995
-
86.98.150.187:995
-
86.180.31.38:443
-
103.230.180.119:443
-
89.137.52.44:443
-
197.37.7.47:995
-
75.188.35.168:443
-
187.199.203.159:443
-
72.12.115.90:22
-
189.237.6.251:443
-
201.172.31.135:2222
-
201.170.181.247:443
-
105.184.195.104:995
-
177.134.208.155:995
-
125.25.133.221:443
-
114.79.148.170:443
-
180.129.97.57:995
-
58.105.167.35:50000
-
201.145.160.158:443
-
201.103.6.221:443
-
47.156.191.217:443
-
70.51.135.39:2222
-
63.143.92.99:995
-
86.105.44.249:61202
-
100.1.108.246:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 regsvr32.exe 1360 regsvr32.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1360 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1360 4436 regsvr32.exe 85 PID 4436 wrote to memory of 1360 4436 regsvr32.exe 85 PID 4436 wrote to memory of 1360 4436 regsvr32.exe 85 PID 1360 wrote to memory of 336 1360 regsvr32.exe 98 PID 1360 wrote to memory of 336 1360 regsvr32.exe 98 PID 1360 wrote to memory of 336 1360 regsvr32.exe 98 PID 1360 wrote to memory of 336 1360 regsvr32.exe 98 PID 1360 wrote to memory of 336 1360 regsvr32.exe 98
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:336
-
-