Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2022 23:13
Static task
static1
Behavioral task
behavioral1
Sample
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll
Resource
win7-20220715-en
General
-
Target
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll
-
Size
979KB
-
MD5
a54c368c81e44e3e30d39d20735eb2ae
-
SHA1
5381365f8afa1c9dff0da4fdb19a9527b6bf8118
-
SHA256
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b
-
SHA512
abed3a88c56293a6377a87038b3811a07948ddbfbda9c58f21b6fddf4e39b89a059c9d98f764f154df7eba0497ed55907f34fd266bc2917a2cb916e4e49d2cd2
Malware Config
Extracted
qakbot
403.688
AA
1654852856
172.115.177.204:2222
78.177.60.224:443
75.99.168.194:61201
124.40.244.115:2222
32.221.224.140:995
31.35.28.29:443
186.90.153.162:2222
1.161.123.53:995
197.87.182.115:443
86.132.14.70:2078
197.94.94.206:443
74.14.5.179:2222
148.0.56.63:443
217.165.84.253:993
39.44.235.10:995
67.165.206.193:993
210.246.4.69:995
182.191.92.203:995
117.248.109.38:21
1.161.123.53:443
109.12.111.14:443
173.174.216.62:443
120.150.218.241:995
143.0.219.6:995
78.101.91.101:2222
104.34.212.7:32103
196.203.37.215:80
82.152.39.39:443
63.143.92.99:995
92.132.172.197:2222
91.177.173.10:995
217.128.122.65:2222
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
144.202.3.39:443
45.63.1.12:443
149.28.238.199:995
140.82.63.183:443
149.28.238.199:443
45.76.167.26:443
45.76.167.26:995
45.63.1.12:995
144.202.3.39:995
144.202.2.175:443
144.202.2.175:995
140.82.63.183:995
24.43.99.75:443
47.23.89.60:993
103.116.178.85:995
80.11.74.81:2222
41.84.246.251:995
108.60.213.141:443
76.70.9.169:2222
187.207.131.50:61202
58.105.167.36:50000
70.51.135.90:2222
176.67.56.94:443
93.48.80.198:995
148.64.96.100:443
140.82.49.12:443
208.107.221.224:443
39.49.7.196:995
39.44.154.111:995
189.146.87.77:443
176.205.23.48:1194
189.78.107.163:32101
39.52.38.254:995
173.21.10.71:2222
180.129.108.214:995
174.69.215.101:443
73.151.236.31:443
47.157.227.70:443
76.25.142.196:443
189.223.102.22:443
5.32.41.45:443
201.145.165.25:443
190.252.242.69:443
69.14.172.24:443
72.252.157.93:993
72.252.157.93:995
45.46.53.140:2222
72.252.157.93:990
89.101.97.139:443
201.1.202.82:32101
24.139.72.117:443
24.55.67.176:443
191.34.120.8:443
79.80.80.29:2222
179.158.105.44:443
187.251.132.144:22
191.112.4.17:443
101.108.199.194:443
43.248.68.197:2222
45.241.223.115:993
83.110.92.106:443
86.97.9.190:443
120.61.2.215:443
175.145.235.37:443
193.136.1.58:443
39.41.106.95:995
37.186.54.96:995
86.195.158.178:2222
201.172.23.68:2222
40.134.246.185:995
90.120.209.197:2078
96.37.113.36:993
102.182.232.3:995
37.34.253.233:443
94.36.193.176:2222
176.205.23.48:2222
37.208.135.172:6883
84.241.8.23:32103
41.38.167.179:995
72.27.33.160:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
89.86.33.217:443
189.37.80.240:443
86.98.149.168:2222
103.207.85.38:995
71.24.118.253:443
217.165.176.49:2222
109.178.178.110:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.255:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3752 984 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 984 rundll32.exe 984 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3288 wrote to memory of 984 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 984 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 984 3288 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 984 -ip 9841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/984-130-0x0000000000000000-mapping.dmp
-
memory/984-131-0x0000000002840000-0x0000000002937000-memory.dmpFilesize
988KB
-
memory/984-132-0x0000000002EB0000-0x0000000002ED2000-memory.dmpFilesize
136KB
-
memory/984-133-0x0000000002E70000-0x0000000002EA2000-memory.dmpFilesize
200KB
-
memory/984-134-0x0000000002EB0000-0x0000000002ED2000-memory.dmpFilesize
136KB