Analysis
-
max time kernel
55s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
09-06-2022 16:10
Static task
static1
Behavioral task
behavioral1
Sample
ScannedDocuments_8080655.lnk
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ScannedDocuments_8080655.lnk
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
ScannedDocuments_8080655.lnk
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
ScannedDocuments_8080655.lnk
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
local.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
local.dll
Resource
win10-20220414-en
Behavioral task
behavioral7
Sample
local.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral8
Sample
local.dll
Resource
win11-20220223-en
General
-
Target
local.dll
-
Size
843KB
-
MD5
c8407e27ce9bf51688106a1fbe3643af
-
SHA1
1aa5cd097a19e7134f4a1566f77d089a718dfa6e
-
SHA256
4ba3ad5f455f832e3190e4f64569f91d8b0ade3181e7b17249fbfeb523352be3
-
SHA512
1167d1b0830b31825c3b91edc78e27783729cbdd3c0f240e935e76ffbb3d6cc364317aa8a50f6b7980012ee2cee1c19584d588fdfda3645fee9bbd44d7592d39
Malware Config
Extracted
qakbot
403.688
obama187
1654695312
197.164.182.46:993
70.51.135.90:2222
187.251.132.144:22
37.186.54.254:995
80.11.74.81:2222
41.84.236.245:995
24.139.72.117:443
177.94.57.126:32101
37.34.253.233:443
186.90.153.162:2222
32.221.224.140:995
208.107.221.224:443
67.165.206.193:993
63.143.92.99:995
88.232.220.207:443
189.78.107.163:32101
74.14.5.179:2222
148.0.56.63:443
40.134.246.185:995
173.21.10.71:2222
124.40.244.115:2222
24.55.67.176:443
39.44.164.54:995
102.182.232.3:995
39.49.101.104:995
31.35.28.29:443
120.150.218.241:995
197.89.128.201:443
31.48.174.63:2078
173.174.216.62:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
92.132.172.197:2222
179.158.105.44:443
1.161.123.53:443
91.177.173.10:995
217.128.122.65:2222
144.202.3.39:995
144.202.2.175:443
45.76.167.26:995
149.28.238.199:995
140.82.63.183:995
140.82.63.183:443
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
144.202.3.39:443
144.202.2.175:995
45.63.1.12:995
109.12.111.14:443
84.241.8.23:32103
104.34.212.7:32103
108.60.213.141:443
117.248.109.38:21
217.165.109.10:993
82.152.39.39:443
47.23.89.60:993
176.67.56.94:443
148.64.96.100:443
76.70.9.169:2222
182.191.92.203:995
37.210.170.123:2222
202.134.152.2:2222
89.101.97.139:443
86.195.158.178:2222
140.82.49.12:443
93.48.80.198:995
187.207.131.50:61202
191.34.120.8:443
37.208.135.172:6883
75.99.168.194:61201
5.32.41.45:443
120.61.1.225:443
101.51.77.238:443
1.161.123.53:995
86.97.9.190:443
175.145.235.37:443
39.44.235.10:995
196.203.37.215:80
41.38.167.179:995
39.41.17.134:995
58.105.167.36:50000
39.52.119.141:995
76.25.142.196:443
73.151.236.31:443
96.37.113.36:993
174.69.215.101:443
201.142.177.168:443
85.246.82.244:443
201.145.165.25:443
201.172.23.68:2222
72.252.157.93:995
190.252.242.69:443
45.46.53.140:2222
79.80.80.29:2222
72.252.157.93:990
72.27.33.160:443
72.252.157.93:993
90.120.65.153:2078
201.103.141.2:443
69.14.172.24:443
31.215.185.26:2222
191.112.12.128:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
210.246.4.69:995
83.110.92.106:443
180.129.108.214:995
47.157.227.70:443
89.86.33.217:443
177.156.191.231:443
94.36.193.176:2222
217.164.121.161:1194
86.98.149.168:2222
103.207.85.38:995
172.115.177.204:2222
105.27.172.6:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
5.203.199.157:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4772 3156 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2828 wrote to memory of 3156 2828 rundll32.exe rundll32.exe PID 2828 wrote to memory of 3156 2828 rundll32.exe rundll32.exe PID 2828 wrote to memory of 3156 2828 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\local.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\local.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7483⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3156-117-0x0000000000000000-mapping.dmp
-
memory/3156-118-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-119-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-120-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-121-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-122-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-123-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-124-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-125-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-126-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-127-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-128-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-129-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-130-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-131-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-132-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-133-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-134-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-135-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-136-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-137-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-138-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-139-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-140-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-141-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-142-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-143-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-144-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-145-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-146-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-147-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-148-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-149-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-151-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-150-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-152-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-153-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-154-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-155-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-156-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-158-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-160-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-161-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-159-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-163-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-162-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-164-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-165-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-166-0x0000000005F20000-0x0000000005F42000-memory.dmpFilesize
136KB
-
memory/3156-167-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-168-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-170-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-169-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-171-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-172-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-173-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-174-0x0000000005EE0000-0x0000000005F12000-memory.dmpFilesize
200KB
-
memory/3156-175-0x0000000005F20000-0x0000000005F42000-memory.dmpFilesize
136KB
-
memory/3156-176-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3156-177-0x0000000005F20000-0x0000000005F42000-memory.dmpFilesize
136KB