Overview
overview
10Static
static
Contract.lnk
windows7-x64
3Contract.lnk
windows10-2004-x64
3publish/ir...ss.cmd
windows7-x64
1publish/ir...ss.cmd
windows10-2004-x64
1publish/pebbles.dll
windows7-x64
10publish/pebbles.dll
windows10-2004-x64
10publish/pe...sh.vbs
windows7-x64
3publish/pe...sh.vbs
windows10-2004-x64
1Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 15:16
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
publish/irritationTemperateness.cmd
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
publish/irritationTemperateness.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
publish/pebbles.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
publish/pebbles.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
publish/perfunctorinessRehash.vbs
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
publish/perfunctorinessRehash.vbs
Resource
win10v2004-20220812-en
General
-
Target
publish/pebbles.dll
-
Size
481KB
-
MD5
d89521adaf6418e6ebe43b1a1a9d2af9
-
SHA1
38cac8495ef43e51cdac1cb5e85d10137b365bee
-
SHA256
1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
-
SHA512
703db1e11372070dbbabc8a96c8600f079273e4dfad4e5437a5fd4b046187cf9f24b47ad68fadaf3bcf7fb1dcad8ecf98edd299281938eb144c4c6c29d68461f
-
SSDEEP
12288:Y2X+B4HKFVxT5jXAcOf35HI9H5RGqdIhr54f:L5EVl5DC4HDbd
Malware Config
Extracted
qakbot
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 4444 regsvr32.exe 4444 regsvr32.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe 4956 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4444 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 4596 wrote to memory of 4444 4596 regsvr32.exe regsvr32.exe PID 4596 wrote to memory of 4444 4596 regsvr32.exe regsvr32.exe PID 4596 wrote to memory of 4444 4596 regsvr32.exe regsvr32.exe PID 4444 wrote to memory of 4956 4444 regsvr32.exe wermgr.exe PID 4444 wrote to memory of 4956 4444 regsvr32.exe wermgr.exe PID 4444 wrote to memory of 4956 4444 regsvr32.exe wermgr.exe PID 4444 wrote to memory of 4956 4444 regsvr32.exe wermgr.exe PID 4444 wrote to memory of 4956 4444 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\pebbles.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\publish\pebbles.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956