Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
15/09/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
justWould.dll
Resource
win7-20220901-en
windows7-x64
General
- Target justWould.dll
- Size 486KB
- Sample220915-zn76xaeae3
- SHA256 c302adb8d4c9b8c95d1df52b076c728c87c68d3b2103a03c9dde156aecf25f23
- MD5 8f5c7176c7d6918c65709b3473f32e01
- SHA1 6fe72ca7fe4e1ca97e85e08a85debe26a7a8a0fe
- SHA512 5727c80f9c067690a1bd84fd24f5fd06731fec45dbd08d97e0c39f925950b5a3495dbf9c73ac461d0452c555293e233276b6bbf665588566a22487e67798d329
- SSDEEP 12288:tj13EEe5jhTc9RWV0ukYTO0jZtWo16VZo/2LX:th3CFc9RQhu6Z4o1kZpLX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
403.892
-
BB
-
1663241219
-
81.131.161.131:2078
-
217.165.85.223:993
-
37.210.148.30:995
-
200.161.62.126:32101
-
78.100.225.34:2222
-
119.82.111.158:443
-
66.181.164.43:443
-
134.35.13.45:443
-
193.3.19.37:443
-
99.232.140.205:2222
-
197.94.210.133:443
-
87.243.113.104:995
-
84.38.133.191:443
-
14.184.97.67:443
-
123.240.131.1:443
-
194.166.207.160:995
-
78.168.87.170:2222
-
180.180.131.95:443
-
41.99.21.248:443
-
190.44.40.48:995
-
191.84.204.214:995
-
191.97.234.238:995
-
105.99.214.62:995
-
70.51.132.197:2222
-
91.116.160.252:443
-
196.64.231.231:443
-
179.111.111.88:32101
-
2.182.104.151:990
-
72.88.245.71:443
-
99.253.251.74:443
-
154.181.203.230:995
-
64.207.215.69:443
-
85.114.110.108:443
-
102.38.96.108:995
-
109.158.159.179:993
-
186.105.182.127:443
-
71.10.27.196:2222
-
41.69.118.117:995
-
47.146.182.110:443
-
197.204.143.46:443
-
194.49.79.231:443
-
88.242.228.16:53
-
88.231.221.198:443
-
175.110.231.67:443
-
196.92.172.24:8443
-
186.50.245.74:995
-
100.1.5.250:995
-
78.182.113.80:443
-
41.96.171.218:443
-
154.246.182.210:443
-
81.214.220.237:443
-
187.205.222.100:443
-
95.136.41.50:443
-
190.158.58.236:443
-
105.99.80.23:443
-
105.197.192.21:995
-
181.127.138.30:443
-
167.60.82.242:995
-
196.112.34.71:443
-
88.251.38.53:443
-
68.224.229.42:443
-
37.37.206.87:995
-
37.76.197.124:443
-
188.157.6.170:443
-
68.50.190.55:443
-
181.111.20.201:443
-
31.166.116.171:443
-
84.238.253.171:443
-
197.49.50.44:443
-
169.159.95.135:2222
-
45.160.124.211:995
-
113.22.102.155:443
-
211.248.176.4:443
-
186.167.249.206:443
-
85.98.206.165:995
-
139.195.132.210:2222
-
182.213.208.5:443
-
201.177.163.176:443
-
45.183.234.180:443
-
98.180.234.228:443
-
184.82.110.50:995
-
179.24.245.193:995
-
94.99.110.157:995
-
181.56.125.32:443
-
119.42.124.18:443
-
181.231.229.133:443
-
2.89.78.130:993
-
70.81.121.237:2222
-
181.81.116.144:443
-
197.11.128.156:443
-
41.142.132.190:443
-
105.111.60.60:995
-
154.238.151.197:995
-
156.219.49.22:995
-
179.223.89.154:995
-
102.101.231.141:443
-
220.116.250.45:443
-
138.0.114.166:443
-
62.114.193.186:995
-
85.98.46.114:443
-
184.99.123.118:443
-
186.120.58.88:443
-
46.186.216.41:32100
-
156.213.107.29:995
-
27.73.215.46:32102
-
68.151.196.147:995
-
181.59.3.118:443
-
68.129.232.158:443
-
45.241.140.181:995
-
212.156.51.194:443
-
87.75.195.211:443
-
1.10.253.207:443
-
87.220.229.164:2222
-
109.200.165.82:443
-
41.105.197.244:443
-
190.59.247.136:995
-
219.69.103.199:443
-
61.105.45.244:443
-
105.105.104.0:443
-
169.1.47.111:443
-
210.195.18.76:2222
-
118.175.247.124:995
-
88.246.170.2:443
-
95.10.13.82:443
-
171.248.157.128:995
-
118.68.220.199:443
-
139.195.63.45:2222
-
118.216.99.232:443
-
181.80.133.202:443
-
102.40.236.32:995
-
46.116.229.16:443
-
61.70.29.53:443
-
179.108.32.195:443
-
171.238.230.59:443
-
81.56.22.251:995
-
31.32.180.179:443
-
186.64.87.202:443
-
85.139.203.42:32101
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 regsvr32.exe 1436 regsvr32.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe 2496 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1436 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1436 4304 regsvr32.exe 80 PID 4304 wrote to memory of 1436 4304 regsvr32.exe 80 PID 4304 wrote to memory of 1436 4304 regsvr32.exe 80 PID 1436 wrote to memory of 2496 1436 regsvr32.exe 85 PID 1436 wrote to memory of 2496 1436 regsvr32.exe 85 PID 1436 wrote to memory of 2496 1436 regsvr32.exe 85 PID 1436 wrote to memory of 2496 1436 regsvr32.exe 85 PID 1436 wrote to memory of 2496 1436 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\justWould.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\justWould.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-