Analysis
-
max time kernel
83s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll
Resource
win7-20220901-en
General
-
Target
627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll
-
Size
525KB
-
MD5
07c8c11cc4ef73de943134ab8e71850d
-
SHA1
6dffeac5550fd6b2af6738e6cda834767d41a2e5
-
SHA256
4eb7a871f9b479a9d719233dbd9f45c034e9fcf97cf70244f6d6eeaa48665a4d
-
SHA512
4d1f5d32c04ff8e4beb03cc8709ab5e073b4b18d21b6bbe59ab8198e92989d78a45e28234bc9c821455685bcdffc61732d2a00892b2bda396f194244fb68ebf2
-
SSDEEP
12288:sWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:jijHHKH53vU7UsNxwn
Malware Config
Extracted
qakbot
403.780
azd
1661969003
72.252.157.93:990
72.252.157.93:995
187.172.230.151:443
46.107.48.202:443
70.46.220.114:443
173.189.167.21:995
93.48.80.198:995
99.232.140.205:2222
89.211.179.14:2222
37.210.148.30:995
182.191.92.203:995
41.228.22.180:443
70.51.153.182:2222
47.180.172.159:443
47.23.89.61:993
173.21.10.71:2222
208.107.221.224:443
76.25.142.196:443
63.143.92.99:995
24.158.23.166:995
32.221.224.140:995
148.64.96.100:443
37.34.253.233:443
197.167.27.20:993
66.230.104.103:443
177.45.208.251:32101
24.139.72.117:443
63.143.92.99:443
120.150.218.241:995
24.55.67.176:443
217.165.77.134:995
5.81.177.28:2078
172.115.177.204:2222
104.34.212.7:32103
217.165.77.134:443
47.23.89.61:995
186.64.87.202:443
78.101.202.75:50010
24.178.196.158:2222
67.209.195.198:443
197.94.210.133:443
41.84.233.188:443
85.104.122.231:443
39.44.43.99:995
217.165.85.153:993
39.57.40.50:995
196.203.37.215:80
217.164.121.181:1194
197.89.12.193:443
1.161.70.129:995
121.7.223.38:2222
39.52.1.59:995
212.70.96.76:995
32.221.224.140:443
174.69.215.101:443
39.41.117.139:995
45.46.53.140:2222
47.180.84.164:443
81.193.30.90:443
100.38.242.113:995
179.158.103.236:443
111.125.245.116:995
39.49.45.146:995
47.156.129.52:443
117.248.109.38:21
118.172.249.102:443
118.163.113.140:443
188.136.218.20:61202
69.14.172.24:443
86.213.191.206:2078
176.45.233.14:995
82.41.63.217:443
67.69.166.79:2222
217.164.237.54:2222
100.38.242.113:443
120.61.3.17:443
101.50.90.44:995
217.128.122.65:2222
217.128.122.65:443
88.227.46.238:443
223.229.136.61:443
72.252.157.93:993
76.185.151.214:443
2.34.12.8:443
179.225.245.173:32101
157.51.47.233:50001
83.79.86.27:2222
109.12.111.14:443
151.38.39.7:2222
208.101.89.137:443
96.37.113.36:993
200.90.119.139:2222
39.53.181.164:995
31.215.98.74:443
98.50.153.207:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3812 4476 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4476 rundll32.exe 4476 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1572 wrote to memory of 4476 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 4476 1572 rundll32.exe rundll32.exe PID 1572 wrote to memory of 4476 1572 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4476 -ip 44761⤵