Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/09/2022, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
MARGINALITY.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
MARGINALITY.dll
-
Size
703KB
-
MD5
069fbff5bbfa4dd3295442b26893c6bb
-
SHA1
1ef32f07ffb2f1cf5198203b7d263fd74d50939b
-
SHA256
42ad1e843f44a725a6666d3d27f10caaa2252a05e1bc0b9c3c315496728f9f25
-
SHA512
4c54c38d2f7a3fdcc154747d71db2a4871131e3a632eb5ede959f03370af9ba651825ed2a4318553ec0feeb82da1389cf15c4e74390d44edc72ddc01ea1eaa69
-
SSDEEP
12288:10cDgZApguXaZhjxA8DPG+WAHlKHnhMIEe5UT+QD1lNMABa:6w76Za8Gy8HnP5w9Mqa
Malware Config
Extracted
qakbot
403.895
BB
1663698873
173.218.180.91:443
134.35.13.43:443
197.94.84.128:443
70.51.132.197:2222
181.118.183.123:443
189.19.189.222:32101
41.111.1.60:995
70.49.33.200:2222
99.232.140.205:2222
139.228.33.176:2222
193.3.19.37:443
41.99.57.155:443
177.255.14.99:995
31.54.39.153:2078
191.97.234.238:995
105.159.30.48:443
217.165.146.41:993
119.82.111.158:443
66.181.164.43:443
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
64.207.215.69:443
109.155.5.164:993
190.44.40.48:995
187.205.222.100:443
76.169.76.44:2222
72.88.245.71:443
197.204.243.167:443
68.53.110.74:995
41.69.103.179:995
68.224.229.42:443
100.1.5.250:995
194.166.205.204:995
88.232.207.24:443
14.183.63.12:443
89.211.223.138:2222
85.98.206.165:995
191.254.74.89:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
180.180.131.95:443
191.84.204.214:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 rundll32.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe 1112 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1536 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1504 wrote to memory of 1536 1504 rundll32.exe 26 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27 PID 1536 wrote to memory of 1112 1536 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MARGINALITY.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MARGINALITY.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-