Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
305s -
max time network
245s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
LearnS.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
assaulting/binders.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
assaulting/deliberatesCinching.js
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
assaulting/hypochondriasisArtistically.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
assaulting/binders.dll
-
Size
379KB
-
MD5
7512d5f067159b8656db56e7ca0676ac
-
SHA1
751ce3feb83e8201109a3db61049a4fd7ac07f62
-
SHA256
b581c1df89df87359786a32ac8f4fcdc804b39447ffdc37d865082d761bcd1e8
-
SHA512
acc3072da39d527a102108a9e0c18ab030836b38095bd13ca6e9a18addba7cd61500d568ab920023d43abdd3eba599bf62151eaea7f2add2a78c98a638bb10ee
-
SSDEEP
6144:XiNznfIiXRVvxXR+09XLbbZR6/AOfJClL+VNWXpImIQ:XilfZV+0tLbsj6L+V4
Malware Config
Extracted
qakbot
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 regsvr32.exe 3068 regsvr32.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe 4912 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3068 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3068 2040 regsvr32.exe 81 PID 2040 wrote to memory of 3068 2040 regsvr32.exe 81 PID 2040 wrote to memory of 3068 2040 regsvr32.exe 81 PID 3068 wrote to memory of 4912 3068 regsvr32.exe 82 PID 3068 wrote to memory of 4912 3068 regsvr32.exe 82 PID 3068 wrote to memory of 4912 3068 regsvr32.exe 82 PID 3068 wrote to memory of 4912 3068 regsvr32.exe 82 PID 3068 wrote to memory of 4912 3068 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\assaulting\binders.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\assaulting\binders.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-