Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/09/2022, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
twinkle.db.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
twinkle.db.dll
-
Size
695KB
-
MD5
44ee81238a82607f711237d670cb88b2
-
SHA1
25f4cbc56d9970d837f8ba3059956db4dbe0e1bd
-
SHA256
466484398eb25d42b0e0b095f10590a566610447eb212d1dc7f7bd342e89fe5a
-
SHA512
19a9b4e79dc7d2752ae4a3f6d71b3ea8e0ee00022b259bf635e0c2f053ede53b5d7c8b217c232d15df299c47d953d026b3f1fc0af6bfb85fb940ba339f4c4385
-
SSDEEP
12288:nieL1vc1PdFjpmw5qS6xnGWmE/N285UT+QD1lNMA:i81IFnqnmEl5w9M
Malware Config
Extracted
qakbot
403.895
obama207
1664363417
217.165.146.158:993
41.97.179.58:443
86.132.13.49:2078
197.203.50.195:443
85.245.143.94:443
86.196.181.62:2222
102.190.190.242:995
105.184.133.198:995
179.111.23.186:32101
179.251.119.206:995
84.3.85.30:443
39.44.5.104:995
197.41.235.69:995
193.3.19.137:443
186.81.122.168:443
103.173.121.17:443
41.104.80.233:443
102.189.184.12:995
156.199.90.139:443
14.168.180.223:443
41.140.98.37:995
156.205.3.210:993
139.228.33.176:2222
134.35.12.0:443
49.205.197.13:443
131.100.40.13:995
73.252.27.208:995
82.217.55.20:443
176.177.136.35:443
180.232.159.9:443
41.68.209.102:995
186.90.144.235:2222
191.92.125.254:443
41.96.204.133:443
58.186.75.42:443
85.86.242.245:443
187.193.143.111:443
200.175.173.80:443
197.49.68.15:995
186.50.139.45:995
41.68.155.190:443
186.72.236.88:995
187.150.143.159:443
105.69.189.28:995
160.177.207.113:8443
41.102.97.28:443
193.254.32.156:443
88.168.84.62:443
156.218.169.48:995
41.105.159.42:443
186.53.115.151:995
186.48.206.63:995
151.231.60.200:2083
196.217.32.15:443
102.157.212.143:443
189.189.89.32:443
181.177.156.209:443
85.94.178.73:995
201.209.4.2:443
41.69.236.243:995
74.133.189.36:443
149.126.159.254:443
41.104.132.166:443
188.157.6.170:443
197.160.22.10:443
187.189.68.8:443
109.128.221.164:995
92.98.73.123:443
154.237.235.43:995
212.102.56.47:443
110.238.39.214:443
185.233.79.238:995
154.237.60.254:995
181.206.46.7:443
186.16.163.94:443
75.71.96.226:995
181.105.32.5:443
41.227.228.31:443
197.203.142.42:443
118.174.89.216:443
41.107.112.236:995
105.96.207.25:443
111.125.157.230:443
68.224.229.42:443
190.44.40.48:995
88.232.207.24:443
72.88.245.71:443
119.82.111.158:443
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
197.94.84.128:443
41.96.130.46:80
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
76.169.76.44:2222
68.53.110.74:995
41.69.103.179:995
194.166.205.204:995
89.211.223.138:2222
85.98.206.165:995
177.103.94.155:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
91.116.160.252:443
151.234.63.48:990
99.253.251.74:443
41.40.146.5:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 744 rundll32.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe 1600 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 744 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 1660 wrote to memory of 744 1660 rundll32.exe 28 PID 744 wrote to memory of 1600 744 rundll32.exe 29 PID 744 wrote to memory of 1600 744 rundll32.exe 29 PID 744 wrote to memory of 1600 744 rundll32.exe 29 PID 744 wrote to memory of 1600 744 rundll32.exe 29 PID 744 wrote to memory of 1600 744 rundll32.exe 29 PID 744 wrote to memory of 1600 744 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\twinkle.db.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\twinkle.db.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
-