Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
07/04/2022, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
0fa38d62e10a8aae27e6624c29e94dc0.dll
Resource
win7-20220331-en
windows7_x64
General
- Target 0fa38d62e10a8aae27e6624c29e94dc0.dll
- Size 1.2MB
- Sample220407-tsg8dsfefk
- SHA256 1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
- MD5 0fa38d62e10a8aae27e6624c29e94dc0
- SHA1 38eacb884c084f9e455e6e32002661a95bb7e4f5
- SHA512 bb283a71face353a3cec670442ddef2b8eab5fcfe1d0893c7ed195880356f4181f1b56854a54e95174b518db7c72fa9e094954e81fa10149c6cfb3424b650419
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.573
-
AA
-
1649273252
-
47.23.89.62:993
-
187.207.48.194:61202
-
45.63.1.12:995
-
140.82.63.183:995
-
45.76.167.26:995
-
140.82.63.183:443
-
144.202.2.175:995
-
144.202.3.39:443
-
149.28.238.199:443
-
144.202.3.39:995
-
45.63.1.12:443
-
149.28.238.199:995
-
45.76.167.26:443
-
144.202.2.175:443
-
100.1.108.246:443
-
32.221.224.140:995
-
24.55.67.176:443
-
31.35.28.29:443
-
70.51.134.168:2222
-
71.13.93.154:2222
-
83.110.85.209:995
-
37.34.253.233:443
-
181.208.248.227:443
-
39.33.181.190:995
-
201.145.189.252:443
-
70.46.220.114:443
-
91.177.173.10:995
-
67.209.195.198:443
-
24.178.196.158:2222
-
174.69.215.101:443
-
172.114.160.81:995
-
73.151.236.31:443
-
89.211.187.3:2222
-
179.158.105.44:443
-
187.102.135.142:2222
-
217.128.122.65:2222
-
92.154.9.41:2222
-
47.156.191.217:443
-
72.252.201.34:990
-
209.197.176.40:995
-
120.150.218.241:995
-
63.143.92.99:995
-
96.29.208.97:443
-
74.15.2.252:2222
-
76.70.9.169:2222
-
75.113.214.234:2222
-
86.98.208.214:2222
-
96.37.113.36:993
-
190.73.3.148:2222
-
76.69.155.202:2222
-
72.76.94.99:443
-
191.17.223.93:32101
-
103.139.243.207:990
-
38.70.253.226:2222
-
189.178.217.247:22
-
173.21.10.71:2222
-
108.60.213.141:443
-
72.252.201.34:995
-
75.99.168.194:443
-
203.122.46.130:443
-
148.64.96.100:443
-
47.180.172.159:443
-
140.82.49.12:443
-
47.23.89.62:995
-
181.118.183.98:443
-
96.21.251.127:2222
-
41.228.22.180:443
-
190.252.242.69:443
-
94.59.57.24:2222
-
31.215.69.127:443
-
182.191.92.203:995
-
176.67.56.94:443
-
207.170.238.231:443
-
66.98.42.102:443
-
83.110.85.209:443
-
76.169.147.192:32103
-
208.107.221.224:443
-
172.115.177.204:2222
-
46.107.48.202:443
-
93.48.80.198:995
-
24.43.99.75:443
-
201.211.64.196:2222
-
102.140.71.72:443
-
83.110.75.97:2222
-
72.12.115.90:22
-
75.99.168.194:61201
-
40.134.246.185:995
-
45.9.20.200:443
-
173.174.216.62:443
-
47.180.172.159:50010
-
181.62.0.59:443
-
45.46.53.140:2222
-
143.0.34.185:443
-
196.203.37.215:80
-
191.112.29.181:443
-
109.12.111.14:443
-
41.230.62.211:993
-
82.152.39.39:443
-
31.48.166.122:2078
-
41.107.230.119:443
-
90.120.65.153:2078
-
140.0.161.213:2222
-
1.161.121.58:443
-
85.246.82.244:443
-
86.195.158.178:2222
-
189.135.97.234:443
-
37.210.238.79:61202
-
5.95.58.211:2087
-
105.226.83.196:995
-
103.107.113.120:443
-
80.11.74.81:2222
-
41.38.167.179:995
-
120.61.1.185:443
-
81.215.196.174:443
-
78.161.215.162:443
-
202.134.152.2:2222
-
109.228.220.196:443
-
159.146.13.168:995
-
176.205.119.81:2078
-
92.177.45.46:2078
-
39.49.81.128:995
-
31.56.252.29:32103
-
117.248.109.38:21
-
197.87.144.193:443
-
102.159.243.153:443
-
144.136.35.102:2222
-
45.241.214.192:995
-
42.235.146.7:2222
-
83.110.157.57:2222
-
71.74.12.34:443
-
103.230.180.119:443
-
39.44.144.159:995
-
197.162.118.178:993
-
103.116.178.85:995
-
113.11.89.165:995
-
103.88.226.30:443
-
2.50.137.197:443
-
1.161.121.58:995
-
175.145.235.37:443
-
86.98.156.250:993
-
75.188.35.168:443
-
39.52.34.138:995
-
94.36.195.250:2222
-
58.105.167.36:50000
-
41.84.232.168:995
-
121.74.178.16:995
-
119.158.126.69:995
-
76.25.142.196:443
-
201.124.1.172:443
-
191.99.191.28:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1060 regsvr32.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe 616 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1060 regsvr32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1920 wrote to memory of 1060 1920 regsvr32.exe 28 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29 PID 1060 wrote to memory of 616 1060 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:616
-
-