Analysis
- max time kernel
4294211s - max time network
125s - platform
windows7_x64 - resource
win7-20220310-en - submitted
01/04/2022, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d.dll
Resource
win7-20220310-en
windows7_x64
General
- Target 0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d.dll
- Size 848KB
- Sample220401-vmytmaafel
- SHA256 0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d
- MD5 a6975ceaedceb806a4f49e103c50a341
- SHA1 19b2cacfd4fa76d9aaa4a3d4a666fc93a509acf6
- SHA512 ac91fea98cc8dfcf2d3396e008e5e72ea8d40e72554b560e0be6febbc4ae0e21778b168ec5514c8cacb96f76b977e4015a7e68ba0f917a3a2f61014687766afa
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.549
-
obama173
-
1648712096
-
176.67.56.94:443
-
148.64.96.100:443
-
47.180.172.159:443
-
47.23.89.62:995
-
96.21.251.127:2222
-
140.82.49.12:443
-
103.88.226.30:443
-
92.177.45.46:2078
-
82.84.66.211:2222
-
83.110.157.57:2222
-
41.228.22.180:443
-
75.188.35.168:443
-
83.110.85.209:443
-
113.11.89.170:995
-
182.191.92.203:995
-
103.230.180.119:443
-
24.43.99.75:443
-
37.186.54.166:995
-
72.76.94.99:443
-
175.145.235.37:443
-
75.99.168.194:61201
-
45.9.20.200:443
-
47.180.172.159:50010
-
207.170.238.231:443
-
85.246.82.244:443
-
173.174.216.62:443
-
70.57.207.83:443
-
86.195.158.178:2222
-
45.241.152.155:993
-
149.28.238.199:443
-
45.76.167.26:995
-
47.23.89.62:993
-
149.28.238.199:995
-
144.202.2.175:995
-
140.82.63.183:443
-
45.76.167.26:443
-
140.82.63.183:995
-
45.63.1.12:443
-
144.202.2.175:443
-
45.63.1.12:995
-
144.202.3.39:995
-
144.202.3.39:443
-
83.110.85.209:995
-
31.35.28.29:443
-
93.48.80.198:995
-
208.107.221.224:443
-
32.221.224.140:995
-
80.11.74.81:2222
-
117.248.109.38:21
-
87.139.163.216:995
-
71.13.93.154:2222
-
103.107.113.120:443
-
105.186.127.127:995
-
5.95.58.211:2087
-
172.115.177.204:2222
-
209.197.176.40:995
-
70.46.220.114:443
-
47.156.131.10:443
-
91.177.173.10:995
-
201.103.199.197:443
-
172.114.160.81:995
-
195.32.32.122:80
-
1.161.75.18:995
-
191.249.126.43:443
-
102.65.38.90:443
-
121.74.182.236:995
-
86.98.27.253:443
-
173.21.10.71:2222
-
24.178.196.158:2222
-
217.164.117.187:2222
-
67.209.195.198:443
-
78.188.76.167:443
-
46.198.215.60:995
-
37.152.80.105:443
-
39.49.46.114:995
-
78.100.225.12:2222
-
24.152.219.253:995
-
86.220.98.71:2222
-
217.128.122.65:2222
-
120.150.218.241:995
-
103.87.95.133:2222
-
202.134.152.2:2222
-
102.140.71.10:443
-
217.164.117.187:1194
-
190.73.3.148:2222
-
161.142.56.8:443
-
74.15.2.252:2222
-
180.183.128.80:2222
-
76.70.9.169:2222
-
75.113.214.234:2222
-
203.122.46.130:443
-
76.69.155.202:2222
-
86.98.208.214:2222
-
75.99.168.194:443
-
1.161.75.18:443
-
120.61.3.249:443
-
86.98.157.14:993
-
108.60.213.141:443
-
39.44.144.159:995
-
45.46.53.140:2222
-
39.41.142.101:995
-
73.151.236.31:443
-
174.69.215.101:443
-
47.158.25.67:443
-
117.102.102.186:443
-
191.99.191.28:443
-
76.169.147.192:32103
-
201.172.31.135:2222
-
76.25.142.196:443
-
201.145.189.252:443
-
71.74.12.34:443
-
96.37.113.36:993
-
187.250.114.15:443
-
181.62.0.59:443
-
190.252.242.69:443
-
189.176.231.229:443
-
72.252.201.34:995
-
67.165.206.193:993
-
5.32.41.45:443
-
41.38.167.179:995
-
72.252.201.34:990
-
209.180.70.25:443
-
72.12.115.90:22
-
63.143.92.99:995
-
70.51.134.168:2222
-
40.134.246.185:995
-
100.1.108.246:443
-
24.229.150.54:995
-
143.0.34.185:443
-
24.55.67.176:443
-
177.222.51.50:443
-
109.12.111.14:443
-
47.156.191.217:443
-
187.102.135.142:2222
-
179.158.105.44:443
-
191.112.12.240:443
-
191.205.7.5:32101
-
81.60.217.218:995
-
200.58.84.99:443
-
41.84.241.23:995
-
125.24.101.65:443
-
2.42.176.91:443
-
81.132.186.248:2078
-
177.16.139.134:443
-
82.152.39.39:443
-
43.252.72.97:2222
-
176.88.238.122:995
-
201.212.192.206:443
-
197.87.144.34:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 regsvr32.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe 1580 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1548 regsvr32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1616 wrote to memory of 1548 1616 regsvr32.exe 27 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30 PID 1548 wrote to memory of 1580 1548 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-