Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
13/04/2022, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
3.dll
Resource
win7-20220331-en
windows7_x64
General
- Target 3.dll
- Size 1.2MB
- Sample220413-l4g3rsecc2
- SHA256 795dfd11462e52d90eff5777f2842e503bb352441e86877e1822708631fab34c
- MD5 29b2e25e3c2ff9c423750be9810e6cb7
- SHA1 6c8a67ede2cdff1217ffb0bb91d879a463d78f2f
- SHA512 141f97d87a2490f91bab18032e691a7832a9ec408d034333dd564919e2e44640ee5bf894e351b2d016467f18d181efcad517e817e11d0cf46bd392c9a909b020
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.573
-
AA
-
1649660590
-
41.228.22.180:443
-
47.23.89.62:995
-
176.67.56.94:443
-
103.107.113.120:443
-
148.64.96.100:443
-
47.180.172.159:443
-
181.118.183.98:443
-
140.82.49.12:443
-
103.87.95.133:2222
-
96.21.251.127:2222
-
197.167.62.14:993
-
46.107.48.202:443
-
24.43.99.75:443
-
172.115.177.204:2222
-
80.11.74.81:2222
-
66.98.42.102:443
-
75.99.168.194:61201
-
173.174.216.62:443
-
45.9.20.200:443
-
39.41.158.185:995
-
187.207.48.194:61202
-
41.84.237.10:995
-
93.48.80.198:995
-
105.226.83.196:995
-
144.202.2.175:443
-
45.76.167.26:995
-
144.202.3.39:443
-
144.202.3.39:995
-
140.82.63.183:443
-
45.63.1.12:995
-
140.82.63.183:995
-
144.202.2.175:995
-
45.63.1.12:443
-
149.28.238.199:443
-
45.76.167.26:443
-
149.28.238.199:995
-
47.180.172.159:50010
-
71.13.93.154:2222
-
86.98.33.141:443
-
31.35.28.29:443
-
113.11.89.165:995
-
175.145.235.37:443
-
117.248.109.38:21
-
94.59.138.62:2222
-
32.221.224.140:995
-
5.95.58.211:2087
-
81.215.196.174:443
-
176.88.238.122:995
-
94.59.138.62:1194
-
92.132.172.197:2222
-
70.46.220.114:443
-
78.87.206.213:995
-
197.89.108.252:443
-
39.44.144.159:995
-
176.205.119.81:2078
-
91.177.173.10:995
-
72.76.94.99:443
-
24.178.196.158:2222
-
1.161.71.109:995
-
172.114.160.81:995
-
173.21.10.71:2222
-
1.161.71.109:443
-
86.97.11.43:443
-
217.128.122.65:2222
-
86.98.33.141:995
-
203.122.46.130:443
-
89.211.181.64:2222
-
37.186.54.254:995
-
86.98.208.214:2222
-
83.110.75.97:2222
-
202.134.152.2:2222
-
120.150.218.241:995
-
45.46.53.140:2222
-
180.129.102.214:995
-
217.164.210.192:443
-
217.165.147.83:993
-
84.241.8.23:32103
-
180.183.128.80:2222
-
74.15.2.252:2222
-
76.70.9.169:2222
-
47.23.89.62:993
-
75.113.214.234:2222
-
208.107.221.224:443
-
76.169.147.192:32103
-
190.73.3.148:2222
-
76.69.155.202:2222
-
96.29.208.97:443
-
108.60.213.141:443
-
75.99.168.194:443
-
182.191.92.203:995
-
73.151.236.31:443
-
38.70.253.226:2222
-
39.52.75.201:995
-
121.74.167.191:995
-
201.211.64.196:2222
-
71.74.12.34:443
-
191.99.191.28:443
-
85.246.82.244:443
-
101.50.103.193:995
-
182.253.189.74:2222
-
67.209.195.198:443
-
90.120.65.153:2078
-
37.34.253.233:443
-
96.37.113.36:993
-
181.62.0.59:443
-
41.38.167.179:995
-
197.205.127.234:443
-
45.241.232.25:995
-
185.69.144.209:443
-
2.50.137.197:443
-
73.67.152.98:2222
-
76.25.142.196:443
-
125.168.47.127:2222
-
201.145.189.252:443
-
109.12.111.14:443
-
102.182.232.3:995
-
72.12.115.90:22
-
47.156.191.217:443
-
174.69.215.101:443
-
70.51.138.126:2222
-
186.105.121.166:443
-
179.158.105.44:443
-
94.36.195.250:2222
-
109.228.220.196:443
-
120.61.2.95:443
-
103.88.226.30:443
-
103.139.243.207:990
-
68.204.7.158:443
-
196.233.79.3:80
-
39.57.76.82:995
-
187.250.114.15:443
-
103.246.242.202:443
-
190.252.242.69:443
-
5.32.41.45:443
-
100.1.108.246:443
-
72.252.201.34:995
-
191.17.223.93:32101
-
40.134.246.185:995
-
187.102.135.142:2222
-
191.34.199.129:443
-
181.208.248.227:443
-
138.204.24.70:443
-
209.197.176.40:995
-
42.235.146.7:2222
-
82.152.39.39:443
-
41.230.62.211:993
-
31.48.166.122:2078
-
187.251.132.144:22
-
143.0.34.185:443
-
88.228.250.126:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1664 regsvr32.exe 1664 regsvr32.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe 4780 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1664 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1664 1456 regsvr32.exe 80 PID 1456 wrote to memory of 1664 1456 regsvr32.exe 80 PID 1456 wrote to memory of 1664 1456 regsvr32.exe 80 PID 1664 wrote to memory of 4780 1664 regsvr32.exe 88 PID 1664 wrote to memory of 4780 1664 regsvr32.exe 88 PID 1664 wrote to memory of 4780 1664 regsvr32.exe 88 PID 1664 wrote to memory of 4780 1664 regsvr32.exe 88 PID 1664 wrote to memory of 4780 1664 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-