Overview
overview
10Static
static
Contract.lnk
windows7-x64
3Contract.lnk
windows10-2004-x64
3unbelt/che...awn.js
windows7-x64
3unbelt/che...awn.js
windows10-2004-x64
1unbelt/cymbal.dll
windows7-x64
10unbelt/cymbal.dll
windows10-2004-x64
10unbelt/ski...on.cmd
windows7-x64
1unbelt/ski...on.cmd
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 03:02
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
unbelt/cherishingYawn.js
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
unbelt/cherishingYawn.js
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
unbelt/cymbal.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
unbelt/cymbal.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
unbelt/skitsAdmiration.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
unbelt/skitsAdmiration.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
unbelt/cymbal.dll
-
Size
849KB
-
MD5
747a50a101b528a155c8095f1aef0230
-
SHA1
7a8c734481c95117009c57c8c81e077a2a5c5d96
-
SHA256
01fd6e0c8393a5f4112ea19a26bedffb31d6a01f4d3fe5721ca20f479766208f
-
SHA512
d5da3700be5c84bcb3bd3700f48d021c4fae0b0c64e8cc8fdf06d8094a4d3a497acf2fafcc05b0f6dbfa2e3e7be6d0b62c08f0328808837791ec586b7a690582
-
SSDEEP
12288:VByskGoWHwa0nZXKlhb/H9TT+iTojfQCA3kptT68JtQzB5UT+QD1lNMAFa:SnEjYNAeh4X668Jc5w9M+a
Malware Config
Extracted
qakbot
403.895
BB
1663774884
70.49.33.200:2222
181.118.183.123:443
99.232.140.205:2222
31.54.39.153:2078
173.218.180.91:443
193.3.19.37:443
134.35.8.88:443
41.97.152.42:443
70.51.132.197:2222
41.111.74.35:995
189.19.189.222:32101
105.156.139.150:443
217.165.68.59:993
119.82.111.158:443
111.125.157.230:443
125.25.129.70:443
197.94.84.128:443
177.255.14.99:995
187.205.222.100:443
190.44.40.48:995
139.228.33.176:2222
191.97.234.238:995
66.181.164.43:443
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
109.155.5.164:993
76.169.76.44:2222
72.88.245.71:443
197.204.243.167:443
68.53.110.74:995
41.69.103.179:995
68.224.229.42:443
100.1.5.250:995
194.166.205.204:995
88.232.207.24:443
14.183.63.12:443
89.211.223.138:2222
85.98.206.165:995
191.254.74.89:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 rundll32.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe 1136 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1720 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1712 wrote to memory of 1720 1712 rundll32.exe 26 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27 PID 1720 wrote to memory of 1136 1720 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\unbelt\cymbal.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\unbelt\cymbal.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136
-
-