Analysis
-
max time kernel
61s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:43
Static task
static1
Behavioral task
behavioral1
Sample
decentralization.dll
Resource
win7-20220812-en
General
-
Target
decentralization.dll
-
Size
849KB
-
MD5
747a50a101b528a155c8095f1aef0230
-
SHA1
7a8c734481c95117009c57c8c81e077a2a5c5d96
-
SHA256
01fd6e0c8393a5f4112ea19a26bedffb31d6a01f4d3fe5721ca20f479766208f
-
SHA512
d5da3700be5c84bcb3bd3700f48d021c4fae0b0c64e8cc8fdf06d8094a4d3a497acf2fafcc05b0f6dbfa2e3e7be6d0b62c08f0328808837791ec586b7a690582
-
SSDEEP
12288:VByskGoWHwa0nZXKlhb/H9TT+iTojfQCA3kptT68JtQzB5UT+QD1lNMAFa:SnEjYNAeh4X668Jc5w9M+a
Malware Config
Extracted
qakbot
403.895
BB
1663774884
70.49.33.200:2222
181.118.183.123:443
99.232.140.205:2222
31.54.39.153:2078
173.218.180.91:443
193.3.19.37:443
134.35.8.88:443
41.97.152.42:443
70.51.132.197:2222
41.111.74.35:995
189.19.189.222:32101
105.156.139.150:443
217.165.68.59:993
119.82.111.158:443
111.125.157.230:443
125.25.129.70:443
197.94.84.128:443
177.255.14.99:995
187.205.222.100:443
190.44.40.48:995
139.228.33.176:2222
191.97.234.238:995
66.181.164.43:443
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
109.155.5.164:993
76.169.76.44:2222
72.88.245.71:443
197.204.243.167:443
68.53.110.74:995
41.69.103.179:995
68.224.229.42:443
100.1.5.250:995
194.166.205.204:995
88.232.207.24:443
14.183.63.12:443
89.211.223.138:2222
85.98.206.165:995
191.254.74.89:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3252 3276 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3276 rundll32.exe 3276 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2740 wrote to memory of 3276 2740 rundll32.exe rundll32.exe PID 2740 wrote to memory of 3276 2740 rundll32.exe rundll32.exe PID 2740 wrote to memory of 3276 2740 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\decentralization.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\decentralization.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3276 -ip 32761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3276-132-0x0000000000000000-mapping.dmp
-
memory/3276-133-0x0000000000550000-0x000000000062A000-memory.dmpFilesize
872KB
-
memory/3276-134-0x0000000000D20000-0x0000000000D42000-memory.dmpFilesize
136KB
-
memory/3276-135-0x0000000000CD0000-0x0000000000D11000-memory.dmpFilesize
260KB
-
memory/3276-136-0x0000000000D20000-0x0000000000D42000-memory.dmpFilesize
136KB