Resubmissions
11-09-2022 11:30
220911-nmg3jsbeb9 1011-09-2022 10:49
220911-mwvvbsbdh4 1008-09-2022 20:23
220908-y54z5sfha5 10Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2022 20:23
Static task
static1
Behavioral task
behavioral1
Sample
627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll
Resource
win7-20220901-en
General
-
Target
627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll
-
Size
525KB
-
MD5
1d1ab6ac00c3ed27bf2a4b1f4a0007a1
-
SHA1
6774518bb3a0e81aea7df6fc57d90187e214fc3d
-
SHA256
627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87
-
SHA512
153bf3adbf03aea21b3f2664cad36747f046002b635830478145016b0d148f380250679949638f491073f997ef89b776480d021f1ae1799308c16954a5948d58
-
SSDEEP
12288:yWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:BijHHKH53vU7UsNxwn
Malware Config
Extracted
qakbot
403.780
azd
1661969003
72.252.157.93:990
72.252.157.93:995
187.172.230.151:443
46.107.48.202:443
70.46.220.114:443
173.189.167.21:995
93.48.80.198:995
99.232.140.205:2222
89.211.179.14:2222
37.210.148.30:995
182.191.92.203:995
41.228.22.180:443
70.51.153.182:2222
47.180.172.159:443
47.23.89.61:993
173.21.10.71:2222
208.107.221.224:443
76.25.142.196:443
63.143.92.99:995
24.158.23.166:995
32.221.224.140:995
148.64.96.100:443
37.34.253.233:443
197.167.27.20:993
66.230.104.103:443
177.45.208.251:32101
24.139.72.117:443
63.143.92.99:443
120.150.218.241:995
24.55.67.176:443
217.165.77.134:995
5.81.177.28:2078
172.115.177.204:2222
104.34.212.7:32103
217.165.77.134:443
47.23.89.61:995
186.64.87.202:443
78.101.202.75:50010
24.178.196.158:2222
67.209.195.198:443
197.94.210.133:443
41.84.233.188:443
85.104.122.231:443
39.44.43.99:995
217.165.85.153:993
39.57.40.50:995
196.203.37.215:80
217.164.121.181:1194
197.89.12.193:443
1.161.70.129:995
121.7.223.38:2222
39.52.1.59:995
212.70.96.76:995
32.221.224.140:443
174.69.215.101:443
39.41.117.139:995
45.46.53.140:2222
47.180.84.164:443
81.193.30.90:443
100.38.242.113:995
179.158.103.236:443
111.125.245.116:995
39.49.45.146:995
47.156.129.52:443
117.248.109.38:21
118.172.249.102:443
118.163.113.140:443
188.136.218.20:61202
69.14.172.24:443
86.213.191.206:2078
176.45.233.14:995
82.41.63.217:443
67.69.166.79:2222
217.164.237.54:2222
100.38.242.113:443
120.61.3.17:443
101.50.90.44:995
217.128.122.65:2222
217.128.122.65:443
88.227.46.238:443
223.229.136.61:443
72.252.157.93:993
76.185.151.214:443
2.34.12.8:443
179.225.245.173:32101
157.51.47.233:50001
83.79.86.27:2222
109.12.111.14:443
151.38.39.7:2222
208.101.89.137:443
96.37.113.36:993
200.90.119.139:2222
39.53.181.164:995
31.215.98.74:443
98.50.153.207:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4248 1684 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1684 rundll32.exe 1684 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1188 wrote to memory of 1684 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 1684 1188 rundll32.exe rundll32.exe PID 1188 wrote to memory of 1684 1188 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1684 -ip 16841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-132-0x0000000000000000-mapping.dmp
-
memory/1684-133-0x0000000000AD0000-0x0000000000B56000-memory.dmpFilesize
536KB
-
memory/1684-135-0x0000000004580000-0x00000000045A2000-memory.dmpFilesize
136KB
-
memory/1684-134-0x0000000004550000-0x0000000004573000-memory.dmpFilesize
140KB