Analysis
-
max time kernel
509s -
max time network
512s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2022 14:05
Static task
static1
Behavioral task
behavioral1
Sample
019338921.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
019338921.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
01970422_890527.lnk
Resource
win7-20220812-en
General
-
Target
019338921.dll
-
Size
1.4MB
-
MD5
7bbeafc1ab9f9d1a48a99338ffec561c
-
SHA1
a4ce6de223addbdc66e747d3abd00b9f190fb5cb
-
SHA256
fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c
-
SHA512
a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263
Malware Config
Extracted
qakbot
403.694
obama186
1654596660
67.165.206.193:993
63.143.92.99:995
74.14.5.179:2222
182.191.92.203:995
197.89.8.51:443
89.101.97.139:443
86.97.9.190:443
124.40.244.115:2222
80.11.74.81:2222
41.215.153.104:995
179.100.20.32:32101
31.35.28.29:443
202.134.152.2:2222
109.12.111.14:443
93.48.80.198:995
120.150.218.241:995
41.38.167.179:995
177.94.57.126:32101
173.174.216.62:443
1.161.101.20:443
88.224.254.172:443
82.41.63.217:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
39.44.213.68:995
84.241.8.23:32103
210.246.4.69:995
92.132.172.197:2222
91.177.173.10:995
217.128.122.65:2222
149.28.238.199:995
45.76.167.26:995
45.63.1.12:443
144.202.2.175:443
45.63.1.12:995
144.202.3.39:995
144.202.2.175:995
45.76.167.26:443
149.28.238.199:443
144.202.3.39:443
140.82.63.183:995
140.82.63.183:443
175.145.235.37:443
85.246.82.244:443
47.23.89.60:993
187.207.131.50:61202
176.67.56.94:443
148.64.96.100:443
140.82.49.12:443
76.70.9.169:2222
217.164.121.161:2222
72.27.33.160:443
108.60.213.141:443
104.34.212.7:32103
39.44.158.215:995
31.48.174.63:2078
75.99.168.194:61201
117.248.109.38:21
83.110.218.147:993
82.152.39.39:443
180.129.108.214:995
5.32.41.45:443
83.110.92.106:443
197.164.182.46:993
196.203.37.215:80
186.90.153.162:2222
37.186.54.254:995
89.211.179.247:2222
24.139.72.117:443
201.142.177.168:443
37.34.253.233:443
69.14.172.24:443
125.24.187.183:443
208.107.221.224:443
174.69.215.101:443
76.25.142.196:443
96.37.113.36:993
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
189.146.90.232:443
70.51.135.90:2222
190.252.242.69:443
201.145.165.25:443
47.157.227.70:443
72.252.157.93:993
177.205.155.85:443
72.252.157.93:995
187.251.132.144:22
40.134.246.185:995
24.55.67.176:443
79.80.80.29:2222
179.158.105.44:443
72.252.157.93:990
89.86.33.217:443
201.172.23.68:2222
102.182.232.3:995
177.156.191.231:443
39.49.96.122:995
94.36.193.176:2222
120.61.1.114:443
217.164.121.161:1194
39.41.29.200:995
86.195.158.178:2222
86.98.149.168:2222
1.161.101.20:995
124.109.35.32:995
172.115.177.204:2222
105.27.172.6:443
32.221.224.140:995
208.101.82.0:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
90.120.65.153:2078
5.203.199.157:995
39.52.41.80:995
148.0.56.63:443
191.112.25.187:443
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
78.101.193.241:6883
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
67.69.166.79:2222
42.228.224.249:2222
172.114.160.81:995
94.26.122.9:995
75.99.168.194:443
189.253.206.105:443
81.215.196.174:443
46.107.48.202:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4812 3708 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3708 rundll32.exe 3708 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4840 wrote to memory of 3708 4840 rundll32.exe rundll32.exe PID 4840 wrote to memory of 3708 4840 rundll32.exe rundll32.exe PID 4840 wrote to memory of 3708 4840 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 7243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3708 -ip 37081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3708-132-0x0000000000000000-mapping.dmp
-
memory/3708-133-0x0000000004AB0000-0x0000000004AD2000-memory.dmpFilesize
136KB
-
memory/3708-134-0x0000000003700000-0x000000000372D000-memory.dmpFilesize
180KB
-
memory/3708-135-0x0000000004AB0000-0x0000000004AD2000-memory.dmpFilesize
136KB