Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
23/03/2022, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034.dll
- Size 816KB
- Sample220323-rwqb3acabl
- SHA256 be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034
- MD5 f4a1c6ac97447ff75a73977f0f4ced82
- SHA1 fc121b9909d13381e9bae6ae4e284e637f93dc3c
- SHA512 c57e6079c4f3a1ff8ccc82adb20cfe8d51a9933ce01bfd1fb2e3b3114d034ac26b7aa99982dfcf4b8a6a2aa453c29dc9bfb0f0e2c5244177603d4eb1d1aa8806
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
qakbot
Version
-
403.549
Botnet
-
azd
Campaign
-
1647016832
C2
-
69.159.200.138:2222
-
32.221.225.247:995
-
186.10.247.110:443
-
71.13.93.154:2222
-
75.99.168.194:61201
-
201.145.160.158:443
-
217.165.79.31:995
-
206.217.0.154:995
-
109.12.111.14:443
-
208.107.221.224:443
-
70.57.207.83:443
-
102.184.187.50:995
-
83.110.153.238:61200
-
70.46.220.114:443
-
201.170.181.247:443
-
91.177.173.10:995
-
188.55.223.134:995
-
76.169.147.192:32103
-
24.55.67.176:443
-
75.159.9.236:443
-
31.35.28.29:443
-
92.177.45.46:2078
-
108.4.67.252:443
-
82.152.39.39:443
-
92.99.229.158:2222
-
89.101.97.139:443
-
78.100.194.196:6883
-
89.211.187.132:2222
-
67.209.195.198:443
-
217.128.122.65:2222
-
76.70.9.169:2222
-
86.195.158.178:2222
-
5.32.41.45:443
-
187.199.203.159:443
-
120.150.218.241:995
-
177.207.67.234:993
-
103.87.95.131:2222
-
86.184.85.199:443
-
191.99.191.28:443
-
172.114.160.81:995
-
2.50.27.78:443
-
209.210.95.228:32100
-
72.76.94.99:443
-
74.15.2.252:2222
-
63.153.150.20:443
-
177.207.67.234:995
-
177.96.102.51:443
-
189.253.32.61:995
-
190.73.3.148:2222
-
139.228.65.100:2222
-
72.12.115.90:22
-
187.170.7.81:443
-
191.112.23.197:443
-
173.21.10.71:2222
-
86.98.11.110:443
-
76.69.155.202:2222
-
72.252.201.34:995
-
207.170.238.231:443
-
217.165.85.106:993
-
45.63.1.12:995
-
90.74.16.2:6881
-
176.67.56.94:443
-
93.48.80.198:995
-
47.180.172.159:443
-
80.11.74.81:2222
-
108.60.213.141:443
-
196.203.37.215:80
-
75.99.168.194:443
-
140.82.49.12:443
-
40.134.247.125:995
-
72.252.201.34:990
-
100.1.108.246:443
-
70.51.139.58:2222
-
31.215.70.127:443
-
47.23.89.58:993
-
24.229.150.54:995
-
217.165.79.31:443
-
24.43.99.75:443
-
63.143.92.99:995
-
24.178.196.158:2222
-
45.76.167.26:443
-
45.76.167.26:995
-
45.63.1.12:443
-
140.82.63.183:443
-
144.202.3.39:995
-
144.202.3.39:443
-
149.28.238.199:443
-
149.28.238.199:995
-
140.82.63.183:995
-
173.174.216.62:443
-
208.101.87.135:443
-
47.23.89.58:995
-
144.202.2.175:995
-
144.202.2.175:443
-
102.65.38.77:443
-
176.232.95.25:995
-
105.186.127.127:995
-
41.205.12.24:443
-
203.212.24.90:995
-
117.248.109.38:21
-
1.161.97.158:443
-
197.89.108.75:443
-
217.128.93.27:2222
-
71.74.12.34:443
-
83.110.218.135:32101
-
5.95.58.211:2087
-
182.191.92.203:995
-
103.139.242.30:990
-
85.1.164.37:2222
-
79.167.199.210:995
-
86.97.209.134:2222
-
103.139.242.30:993
-
80.14.188.219:2222
-
180.183.125.141:2222
-
39.44.188.102:995
-
160.178.61.138:443
-
124.41.193.166:443
-
175.145.235.37:443
-
139.64.13.51:995
-
76.25.142.196:443
-
128.106.122.181:443
-
86.97.209.134:1194
-
197.237.74.185:995
-
58.105.167.35:50000
-
1.161.97.158:995
-
121.74.187.191:995
-
94.26.124.10:995
-
68.204.7.158:443
-
47.156.131.10:443
-
189.146.51.56:443
-
47.156.191.217:443
-
73.151.236.31:443
-
47.180.172.159:50010
-
96.21.251.127:2222
-
38.70.253.226:2222
-
96.246.158.154:995
-
41.228.22.180:443
-
45.9.20.200:443
-
75.188.35.168:443
-
201.42.65.3:995
-
86.198.170.170:2222
-
81.229.130.188:443
-
209.59.248.140:443
-
105.224.105.97:995
-
67.165.206.193:993
-
103.133.11.10:995
-
114.79.148.170:443
-
197.162.123.214:993
-
86.97.9.241:443
-
183.82.103.213:443
Attributes
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 3464 1348 WerFault.exe 83 - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018000814C2D683 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000ce7587561b1486c4931caccfaee4f3c7058f22aeac132997620379d996e8dc5f000000000e800000000200002000000046a6ca1fb4411b929d7e051d3d1ed281fd64cd46bd6fe3045348939a2123e9d580000000f136caa9f9a9820c49994f53f4424e4dce39ad7bb8611b0f5ecbff6a7854600db4324fa6077eb7ac8160a385a0b5f1b57901c31de1e7af251c86ad33c083d5286ae559fd4c25288af0e4f008516eb85c44e943af74d0215e150435438b5d3b9830ce5a82cc061eca10d7a3805a373af45cb8629d5623902c104b9ede09a992cc40000000115ef6cb389691cdb47f371a9c18921272cf825428215e6be7421a983b9b3bf3ceab077ae4d026bc1d92964605283201b203d2787df29ba5b55ae40e80328319 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000008da00a0d0e1c71e730a35ca40f39e8998d7d2808903897b16e8bb3b07d21161f000000000e800000000200002000000020ccc98a7c274f069fde1145ca7a6d7f213c040cadc1690d2a7abcc245c5b7c6100d00007f85b5f6778e5863333b3a1f68da84b96207d366ce74e40861d1aeb37b52d9fd8d582570a50acfb22cf128b948647420170551a6d4c029c72ff9186502bfa539e54c9af563fc02f872e26301775a5a40ee566580d0b1504ca913ead27d0d296f0929ff53d4b4b6d36fdde4b3bf0673af734f56941ab90046db7ff3b4331e3641b48c3950ddf3d3e4f8b372fd64d3b95f829389f5fd0b1b94b73daa0b49ea61e23f15b60cd16a6e85d34b1febf2abb790b67d06af298493585ca5dba1d95a8cd2452bf362fbabacd23d2b5d7cd50799db0ee609bd9024a6fd8242a3fda3183787f8ec41c0136818b459b6bb6e7410c2445025382387e4f2535fdb0857b78c80a99a967c40f4337e9308d04100bf932d6a3db8fc5d397e45b058e26a7015ae6c8ab4ac5454c794c18e7a91fead929899c0c9446c541d6998b7d6791079d0faa9678be7d265a29147379f521902d201d8146d729a76a37c35dfac9de963d40efac1e7a807ec737faabf72c0ef44de8ee50982978f8cd607ee11f4ffff6cfd13dc477f8801b85cbcf3be9c042804d1fd1e84e8cea43440b031ab244108690e51df6d2eed14bb1a636dfc9d1f3f50c65a838411bc2214fec65c4a0a6e79f2cfbe26c98c6ef084cfab60cb868bbf5cb4154a4798d9af2b152eb36b8fe55e47db5f02543ea15b5eaf6445dbb506055d6744f96959e98065b61a60bd58b4c5b712a0ff0f0bb42c18806d0e403d8b04bf8c46a34e3e83681d099a176b96824e832cc39fdbdd3e5a2a109793d007b5a709a1c9ef11881de21c28da5b081d0f0e8903f6a728f1ec40a2d913e51d5e0bdf12651eb13954046b2992af08977c746fb467c1f12914028b0075768156a45171bbabe9c188162e4915264ca13ba71055569cb89a3b772292efb43652f2a103207bc170ae9fe4b09daf71a2eea0fc4ae32c334c32693a6109a27d9f9f25085c8b24f988b756a310842e4026d022610838f36cad161d9c05cf85241ffeac0bd190f8ef934ed1c0dffd16d3e6e620d2cf667b8c46b32da7ca9f336a2c90d0de55a4abd881f3e1d9da60442f0e67643e294d7151c6693620acfb658dd581c8ac9f3eeb0b82b2f2e6624119731fa43026d75fee88976cf2545b49859d3dff3d48025b6dc38cd47fefb72898cdfaeef7420d773ad280cdaaf54767990cba7df7f62a1af3eb0533f36125263be2ff9af90210e750f289c00f23c77d5ea3eb410b9632756cfdf4e8e4e236c39c1f98804273fc8a780afb36e0e542ff5cfa7986efba5cc478f5dea7f49adaa6c48f76a407f46d17e4febf4dfc5d07dad502c8ded78ac05b35a4291ca7675b29a1a7b6a1bc10cc9bb0c17fbeb2fc0d68df6a05dec81bfc145cad9c4f3e2922749625f166d88a90df76288eaca18d15005e3d70c8b51a894623acdfb4f499e262224faf31824433c36eb13b48984d7af9b996f45f7d95c4882e49c0fe36382675d15e6e5af896cba88dfad4fc69964c2b2fb3d7bf157eabda6a408efb5db2c1c08c81d10a56c413a70d1eed69b0ba7c743e0a6517b7ddc213c67120ce3ecc0a508bbea6b2ad9c92407424a5d43ccadc445fdd3a3b32fd947d00d407e1730271bd18768e95fa853a5fc31b684392a4b61771ad28c62f6757b1eb23a6f6de32108f2680d592e5410db041ac0910a2437d843b687d1e5c7a1a06d69b46f0fda1d8cca91ca5cce6d45083e19e2887c1c668d3d871af3e5ef61170c6f1a35bb56711bfaad2ab76a1eb0f2e12a736a882331e77918a13144863022dd2cba836473b17e3b41e7194e6e552009ede0544210bb111330c13b3f209702462e5b64e339decd0f23185ac69394373f2096fe49dea67520b1c1849de945d9f24fc975e445e22194ca5ad989cbc9cf1501f68ecb058e8c19bb91057d977da8b9c189ad0409c8639e7e70200dde58c032389bba09f070e4d83f98b996f9ec3d8d9a4aa913cc46b6f0429480ec2a209a0720e9e4fddeef9ceb98da40be9fb6a76319714624cff023f4369055b23e7d7c4a2f47777fb0ef799f98788ffe974899598b6390ca2c6cf0aec07959fc2db712d5afb564d11ff243bdde461a92f68c086d288f077e2bcb86f3cfa336272b580272f4e00fc4ce1de95919dd171876958c629704f1731efeee0e6d3c13d941ccfb92c689f59b5dc7f844285018fee9313b1313614b21c124424dcb80e9b7f08b5df67383576d9527214db81ec96d9df7596985418f864e5876f242b297b8fbec1b78d83e8bf542d192214d1b83d604ad43357365a59420af83f383ed02bdede7aaaecc0d543399ed303c3bc8e9296ff992fcd74b19d84b776b2b7c2e1cdc26026f4c47ec2e9209da94a007859e69e882887929b633b140dc675592ebf3d8acf94e3ae0858a795f84337e6f0da2343cd20d022d276ab729a27ac7c1ab8ea1c5c37e19098706f51c4ef08b2eb31dc0ebeebd915dbe358553d3a9b83a44aa51149cfe1788a4cc5f44b53f22ff2ea5d434420386228ad93dbc9e93681db3b9bf7fc1c737316907810cb6bb85f5e649ffb45687c2f1eedc4902757b6b1796fc85922807dc8f9eb1ccb46e71042af30a6786e517014f621a06eb903bbd4b461d5491db9c0662cc77037f762386a607542f74ccb8318a027e9789cd26ed01d4aa7890a9c7a6fb0837ec10400c17192bddd761a65f9e4102a5ea7b83aa2d2b7f6ea0182c1134e4ce313353d1cf639f735570463cafbd5ffa9834168a4294f389e6c5cbd333101085c2eedff7e32310ab9f3cf4385057910d3d18c8d73c29109ffb3d8eae2213cd8aa652903a8df5085fe22f2b3ee143f01917e83446a96c760dc9ad33a73955e8da4a6adbc2bb7d610e11959b14f1ca961c299113619f02473ed5360e69ace4f4bb4721f0c1801466a1fd687cdcc8f9a03eb2b9ebd3506d66c9a85130680e1a08238fe46e899baedccf34d806d07240acf0740959ad71fe66c07112f6e1a11dfb60332b352416aa220242b0f0bf1c1e4d72d361adcf8d6806c3f757fcaed8f00ccdb04b4fa8519ab9b2b9863875a6a34759bbdee580dd5190bb5ec9c8dde19087cf72116e361c522ce9a7133c624d037b0bd1819cd10297760ec3fbac41c184e6ee08671aeab1c90d1e419159ab601320661ef4e8b5bd0b8d5a8da7dab58d7c11c108f4fd1a52635cd741bf5eaa34c8abb56a51bc42e934152053a9aad3c0a20bed909075e34f2a5ddd4c1d90303282047621b289511620702be91c9263608765c24f9d995eddbd01ae9e56feccaef84b88ada31be683f16994692cc5c780b42073e9b8ab0c61832b65feb676954c6bb1b4c7505c676eb268388683443981f33cd86964b5251944cc8c0a75750ea099cbe645744581360d2744593f60115805637b87e36affc35de256d2b12713e9096bd8e98558192640e854b2591e636a5249fbd9b7883231b3b5a580fa1549055bff1c7c5a6fb2ab342fbc1371dccc637c849748f69586bea1ce90d3af8635011c4983aff414136169cffeae685621e5bb05901cffd5d834843d174d3a3c72dfeea99a0d4cf693118b2a2dd4a94b9be8ebb81207c93e41f3c77ad9e664c391ee6688781fa7a0d00c824e03142e08b9707fb72c4c28881bb41a151dceb10563a18c534739f5f4ab1076dccf04edfd7459655127e5592f6d904899236cdbaffe44a8963214e769271554c752ce484c1de80a21ef3df1bbc762ae3e6fb9cbbc9afb15b94b52a48c93e659fcfb32dc85f1274736ffcce2e647b540e9109e896625a45b02fe21fd8e367959c58516d5fe4f2574f8593303235c0b2514203a8b73fcb88bc39f1b55f3af52e343bfc57e0d8adb75e040e47e54cd77f5ea1647233f078c669557c7e4f523db45b48920a9063e8a20cf39a1abd78d1cc6c6008c3bc89abb44fdd3cb29c5e13e87447175cc8cd9414d751261866680eda68e385e3bcd0070c5d542da4d7c6f177da0e6ba9b439f6bc7812652328e5a62a9a0a2e9b6fd06ca86c6c161d5f8be00bd91de75377fc2d90e4943d564ac03a329bab09ccedbabf808411a86158d3af63292bb0c7f19e9bcb6643fb87d51ff1a910ee94a9027fc5c0aa5cf22dee23c52725564d0a270e90f92bbd46c66e48b558eb2bf959030fc414296696567e4f92fa7d25814f991fed2eea234534c05f9234cfa0beaececa096a7bbc36632cf9800d95586e37bdb9361dcfdae74e41d435a5bdf0e00718d2859da8ca74a87945f736f11502ddfc1ada77ed162b835bb1627efbd114c479355a6a16ad9a92651260ad7ce740c78122e045a5730a4ca043477392658f1e20fae9733145093dd3624841284c9f4928b8508af925518ed386bf7f88078164e3e55546d63196d0d4c8518b439f9b6dff33f5708a8f763128a67182d0cd995934509d3a042d5fde8cd91be348e0bfee63f16754d8007660beeaad251b87d8eb4c305775f162ea38225203ae724709ee5dffc556e98c79a0901d21ba3e7b6df8973edf05db7b9c0624bf1afd16222646f0cff4c95b7c35574c110ac12732973f93e78512c2bae82b539f13b73be3827b4e1bfa6d091a2b0dc2a1ebe539f38b83ec2e3a44cbc657f4027ef5ea067b10049ff7ed6cb6665e55b70d8a2df967f21c69f4fa13d46c8779bce9f886c26ee838644de3acccb7ad99ba19dc204b59ee3bdeba11bedf85cd09c515ed7137c60ec38714cc07e25022369ceb6bf7e6c03286a9d74cc5ce55190e554000000016ae7c617f9c88437ffa3bdbb0fad6022f803584677d7fedd626b2aa8d4be7532409c18c4c09a7ff87854db07f8d6b12c640d69c0eded0a69bae4c83927ed04b svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018000814C2D683" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1348 rundll32.exe 1348 rundll32.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1348 rundll32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3660 wrote to memory of 1348 3660 rundll32.exe 83 PID 3660 wrote to memory of 1348 3660 rundll32.exe 83 PID 3660 wrote to memory of 1348 3660 rundll32.exe 83 PID 1348 wrote to memory of 1428 1348 rundll32.exe 88 PID 1348 wrote to memory of 1428 1348 rundll32.exe 88 PID 1348 wrote to memory of 1428 1348 rundll32.exe 88 PID 1348 wrote to memory of 1428 1348 rundll32.exe 88 PID 1348 wrote to memory of 1428 1348 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 7003⤵
- Program crash
PID:3464
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1348 -ip 13481⤵PID:1296