Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
197s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
defrosts.dat.dll
Resource
win7-20220812-en
General
-
Target
defrosts.dat.dll
-
Size
650KB
-
MD5
3d348e2c37855dd4a1b94eff371ab3f1
-
SHA1
3e66fc73001380b170e658561f19441262011af6
-
SHA256
f56d25cf9f20f2040b2ec14f769f36aa14819f56f6b254c0831c9b2a024b8c8d
-
SHA512
8cbade23ddcbfcad5ea242e4926e194daad958b8ff61069220165a0fe4b660fc8c19ce56f39ac6bfd4defeb7525b2268665a01b5ebb8aaa2e5c31ee532b50052
-
SSDEEP
12288:e04qh9jnmGxBGex5ikJdspJRtsdi21LcVUK:ayjn5PyVWdR1L/K
Malware Config
Extracted
qakbot
78.116.204.249:27334
32.26.157.231:2190
18.196.211.168:48835
20.143.207.39:26614
129.117.41.161:7982
209.203.201.219:44632
174.59.186.115:33072
88.239.235.151:45186
130.10.116.149:14433
232.176.128.0:0
70.238.223.142:65113
108.212.133.125:43749
91.204.181.165:28980
227.138.255.213:57594
252.124.102.160:59802
84.56.235.30:702
40.12.38.164:4225
163.55.16.87:6230
235.167.221.218:44172
113.34.86.36:44766
3.198.145.208:34010
194.217.45.198:36220
198.194.188.181:22851
149.133.92.184:61270
135.120.183.211:3151
45.206.222.245:43045
246.179.112.12:64397
88.106.24.76:30867
140.20.244.190:8098
218.91.78.249:2943
110.89.234.27:52593
233.62.189.160:62061
93.214.137.155:32352
92.78.239.242:55631
19.141.217.252:49599
215.33.231.196:64020
102.27.14.119:35457
234.211.168.138:25561
247.37.222.37:38694
156.214.152.71:3158
253.253.176.112:1886
190.202.24.117:42564
26.158.22.4:63550
22.123.250.159:36265
121.252.196.62:49429
220.79.21.161:11114
76.149.82.36:432
170.22.170.33:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 regsvr32.exe 4960 regsvr32.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe 4780 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4960 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3808 wrote to memory of 4960 3808 regsvr32.exe 82 PID 3808 wrote to memory of 4960 3808 regsvr32.exe 82 PID 3808 wrote to memory of 4960 3808 regsvr32.exe 82 PID 4960 wrote to memory of 4780 4960 regsvr32.exe 83 PID 4960 wrote to memory of 4780 4960 regsvr32.exe 83 PID 4960 wrote to memory of 4780 4960 regsvr32.exe 83 PID 4960 wrote to memory of 4780 4960 regsvr32.exe 83 PID 4960 wrote to memory of 4780 4960 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\defrosts.dat.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\defrosts.dat.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-