Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
04/04/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
44651,6679619213.dll
Resource
win7-20220331-en
windows7_x64
General
- Target 44651,6679619213.dll
- Size 1.3MB
- Sample220404-rhtsbsfec3
- SHA256 934cb585f33fe11bcd0e99f4df40de07eec50aae0c6d036527fc03fe6d7d0fc8
- MD5 c6cd8c7383f3777a7a469585d93a9c1f
- SHA1 99cd6d47275cf9ad6253ad467f8a6de991463cfc
- SHA512 ff1f3830bca8a2ba1653a6a33e5b9a946b26f18583301cde826f482b726708e416d7a96e546e5f624f669ba4998f68508e57b36752860e969189aac132d2fd42
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.549
-
biden57
-
1649058178
-
45.9.20.200:443
-
173.174.216.62:443
-
187.207.7.231:61202
-
207.170.238.231:443
-
47.180.172.159:50010
-
70.57.207.83:443
-
83.110.75.97:2222
-
58.105.167.36:50000
-
47.23.89.62:993
-
72.76.94.99:443
-
83.110.157.57:2222
-
45.241.145.252:995
-
82.84.66.211:2222
-
75.99.168.194:61201
-
144.202.3.39:443
-
45.63.1.12:995
-
149.28.238.199:995
-
140.82.63.183:443
-
45.63.1.12:443
-
144.202.3.39:995
-
144.202.2.175:443
-
140.82.63.183:995
-
144.202.2.175:995
-
45.76.167.26:995
-
45.76.167.26:443
-
149.28.238.199:443
-
31.35.28.29:443
-
32.221.224.140:995
-
71.13.93.154:2222
-
102.65.38.90:443
-
83.110.85.209:995
-
70.46.220.114:443
-
91.177.173.10:995
-
81.60.218.17:995
-
197.162.118.178:993
-
24.178.196.158:2222
-
37.152.80.105:443
-
172.114.160.81:995
-
103.107.113.120:443
-
176.88.238.122:995
-
67.209.195.198:443
-
86.220.98.71:2222
-
80.11.74.81:2222
-
92.96.182.192:2222
-
5.95.58.211:2087
-
24.152.219.253:995
-
217.128.122.65:2222
-
78.100.227.177:2222
-
39.41.173.204:995
-
92.96.182.192:1194
-
174.69.215.101:443
-
93.48.80.198:995
-
103.87.95.133:2222
-
113.11.89.170:995
-
120.150.218.241:995
-
2.50.137.197:443
-
88.235.143.36:443
-
78.188.76.167:443
-
76.70.9.169:2222
-
75.113.214.234:2222
-
86.98.208.214:2222
-
173.21.10.71:2222
-
190.73.3.148:2222
-
76.69.155.202:2222
-
103.88.226.30:443
-
37.186.54.166:995
-
92.177.45.46:2078
-
180.183.128.80:2222
-
39.49.84.44:995
-
39.44.144.159:995
-
74.15.2.252:2222
-
5.32.41.45:443
-
108.60.213.141:443
-
75.99.168.194:443
-
202.134.152.2:2222
-
176.205.119.81:2078
-
2.50.22.45:443
-
31.215.69.127:443
-
96.21.251.127:2222
-
96.29.208.97:443
-
117.248.109.38:21
-
140.82.49.12:443
-
176.67.56.94:443
-
78.101.150.251:61202
-
203.122.46.130:443
-
148.64.96.100:443
-
47.180.172.159:443
-
47.23.89.62:995
-
66.98.42.102:443
-
83.110.85.209:443
-
76.169.147.192:32103
-
46.107.48.202:443
-
24.43.99.75:443
-
121.74.182.236:995
-
86.98.157.14:993
-
39.52.48.91:995
-
41.228.22.180:443
-
84.241.8.23:32103
-
71.74.12.34:443
-
103.230.180.119:443
-
102.140.70.17:443
-
182.191.92.203:995
-
101.255.82.166:443
-
45.46.53.140:2222
-
208.107.221.224:443
-
73.151.236.31:443
-
143.0.34.185:443
-
41.38.167.179:995
-
109.12.111.14:443
-
144.136.35.102:2222
-
37.34.253.233:443
-
70.51.134.168:2222
-
187.250.114.15:443
-
41.84.246.143:995
-
105.99.164.122:443
-
102.182.232.3:995
-
120.61.1.252:443
-
196.203.37.215:80
-
42.235.149.83:2222
-
90.120.65.153:2078
-
209.197.176.40:995
-
140.0.161.213:2222
-
172.115.177.204:2222
-
96.37.113.36:993
-
72.12.115.90:22
-
85.246.82.244:443
-
201.172.31.135:2222
-
181.62.0.59:443
-
179.158.105.44:443
-
191.112.12.240:443
-
191.251.191.31:443
-
109.228.220.196:443
-
161.142.56.8:443
-
201.211.64.196:2222
-
106.51.48.170:50001
-
39.57.119.44:995
-
102.156.205.117:443
-
89.137.52.44:443
-
114.79.148.170:443
-
105.226.83.196:995
-
75.188.35.168:443
-
112.199.148.55:995
-
201.145.189.252:443
-
187.213.21.78:22
-
187.102.135.142:2222
-
40.134.246.185:995
-
46.103.169.248:995
-
100.1.108.246:443
-
63.143.92.99:995
-
72.252.201.34:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3568 regsvr32.exe 3568 regsvr32.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe 4052 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3568 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3568 2620 regsvr32.exe 80 PID 2620 wrote to memory of 3568 2620 regsvr32.exe 80 PID 2620 wrote to memory of 3568 2620 regsvr32.exe 80 PID 3568 wrote to memory of 4052 3568 regsvr32.exe 81 PID 3568 wrote to memory of 4052 3568 regsvr32.exe 81 PID 3568 wrote to memory of 4052 3568 regsvr32.exe 81 PID 3568 wrote to memory of 4052 3568 regsvr32.exe 81 PID 3568 wrote to memory of 4052 3568 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\44651,6679619213.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\44651,6679619213.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-