Analysis
- max time kernel
167s - max time network
46s - platform
windows7_x64 - resource
win7-20220331-en - submitted
14/04/2022, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll
Resource
win7-20220331-en
windows7_x64
General
- Target 40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll
- Size 819KB
- Sample220414-pgk3pabch9
- SHA256 40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f
- MD5 a898e4c23abc98217037c14129151614
- SHA1 9893df992570c080b253fd9fa28793c7a3f8ebe6
- SHA512 80e0be18fdd08be003a82061499a2c73b01f4a3a1ec0118e089825ee0d0518d5fb02728715acdbd6e438a5b078dc006daff6481d0de811fb6148df2273a78a4d
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
403.549
-
AA
-
1648110482
-
90.120.65.153:2078
-
179.100.109.11:32101
-
24.43.99.75:443
-
37.186.54.166:995
-
47.23.89.62:993
-
72.76.94.99:443
-
117.248.109.38:21
-
75.99.168.194:61201
-
31.215.69.127:443
-
45.9.20.200:443
-
203.122.46.130:443
-
173.174.216.62:443
-
144.202.2.175:995
-
149.28.238.199:443
-
140.82.63.183:443
-
45.63.1.12:443
-
140.82.63.183:995
-
144.202.3.39:995
-
45.63.1.12:995
-
45.76.167.26:995
-
45.76.167.26:443
-
149.28.238.199:995
-
144.202.3.39:443
-
144.202.2.175:443
-
190.206.211.182:443
-
86.195.158.178:2222
-
47.23.89.62:995
-
70.57.207.83:443
-
207.170.238.231:443
-
217.165.85.224:993
-
1.161.80.99:443
-
39.44.127.250:995
-
32.221.225.247:995
-
5.95.58.211:2087
-
180.233.150.134:995
-
45.241.207.212:995
-
188.55.248.211:995
-
71.13.93.154:2222
-
39.33.182.192:995
-
197.2.149.15:443
-
121.74.182.236:995
-
91.177.173.10:995
-
83.110.85.209:995
-
41.230.62.211:993
-
70.46.220.114:443
-
81.60.216.223:995
-
172.115.177.204:2222
-
103.88.226.82:443
-
80.11.74.81:2222
-
114.79.148.170:443
-
89.101.97.139:443
-
172.114.160.81:995
-
67.209.195.198:443
-
75.159.9.236:443
-
201.172.31.135:2222
-
24.178.196.158:2222
-
41.228.22.180:443
-
182.191.92.203:995
-
37.152.80.105:443
-
93.48.80.198:995
-
92.96.183.242:2222
-
24.152.219.253:995
-
113.11.89.170:995
-
195.32.57.18:80
-
197.161.137.196:993
-
39.57.112.37:995
-
105.186.127.127:995
-
78.87.196.125:995
-
217.128.122.65:2222
-
120.150.218.241:995
-
79.52.204.9:50001
-
41.215.152.154:995
-
2.42.176.91:443
-
86.98.208.214:2222
-
190.73.3.148:2222
-
76.70.9.169:2222
-
119.158.97.217:995
-
74.15.2.252:2222
-
209.180.70.25:443
-
75.99.168.194:443
-
118.174.95.247:443
-
76.69.155.202:2222
-
78.188.76.167:443
-
189.146.51.56:443
-
108.60.213.141:443
-
177.97.48.132:443
-
176.67.56.94:443
-
208.107.221.224:443
-
148.64.96.100:443
-
47.180.172.159:443
-
140.82.49.12:443
-
92.96.183.242:1194
-
92.177.45.46:2078
-
96.21.251.127:2222
-
161.142.56.8:443
-
39.49.35.170:995
-
1.161.80.99:995
-
175.145.235.37:443
-
83.110.85.209:443
-
31.35.28.29:443
-
202.134.152.2:2222
-
86.98.27.253:443
-
5.32.41.45:443
-
75.188.35.168:443
-
103.230.180.98:443
-
76.25.142.196:443
-
173.21.10.71:2222
-
189.237.6.251:443
-
76.169.147.192:32103
-
71.74.12.34:443
-
67.165.206.193:993
-
47.158.25.67:443
-
73.151.236.31:443
-
174.69.215.101:443
-
82.41.63.217:443
-
45.46.53.140:2222
-
201.145.226.223:443
-
201.170.181.247:443
-
191.99.191.28:443
-
47.180.172.159:50010
-
69.159.200.138:2222
-
201.103.6.221:443
-
47.156.191.217:443
-
72.252.201.34:990
-
63.143.92.99:995
-
72.12.115.90:22
-
108.4.67.252:443
-
189.248.86.71:443
-
40.134.246.185:995
-
70.51.135.39:2222
-
100.1.108.246:443
-
24.229.150.54:995
-
24.55.67.176:443
-
72.252.201.34:995
-
105.225.175.168:995
-
179.158.105.44:443
-
179.178.78.112:443
-
200.100.246.85:32101
-
109.12.111.14:443
-
2.34.12.8:443
-
143.0.34.185:443
-
81.132.186.248:2078
-
82.152.39.39:443
-
201.172.231.204:443
-
186.106.197.52:443
-
187.211.77.68:443
-
196.203.37.215:80
-
111.125.245.118:995
-
176.88.238.122:995
-
120.61.1.91:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 regsvr32.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe 316 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1436 regsvr32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1632 wrote to memory of 1436 1632 regsvr32.exe 28 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29 PID 1436 wrote to memory of 316 1436 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-