Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Contract.lnk
windows7-x64
3Contract.lnk
windows10-2004-x64
3publish/ca...es.vbs
windows7-x64
3publish/ca...es.vbs
windows10-2004-x64
1publish/de...le.cmd
windows7-x64
1publish/de...le.cmd
windows10-2004-x64
1publish/tidbit.dll
windows7-x64
10publish/tidbit.dll
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
publish/carloadsSingles.vbs
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
publish/carloadsSingles.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
publish/denunciatingShackle.cmd
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
publish/denunciatingShackle.cmd
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
publish/tidbit.dll
Resource
win7-20220901-en
General
-
Target
publish/tidbit.dll
-
Size
481KB
-
MD5
d89521adaf6418e6ebe43b1a1a9d2af9
-
SHA1
38cac8495ef43e51cdac1cb5e85d10137b365bee
-
SHA256
1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
-
SHA512
703db1e11372070dbbabc8a96c8600f079273e4dfad4e5437a5fd4b046187cf9f24b47ad68fadaf3bcf7fb1dcad8ecf98edd299281938eb144c4c6c29d68461f
-
SSDEEP
12288:Y2X+B4HKFVxT5jXAcOf35HI9H5RGqdIhr54f:L5EVl5DC4HDbd
Malware Config
Extracted
qakbot
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4700 regsvr32.exe 4700 regsvr32.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe 4104 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4700 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2556 wrote to memory of 4700 2556 regsvr32.exe 81 PID 2556 wrote to memory of 4700 2556 regsvr32.exe 81 PID 2556 wrote to memory of 4700 2556 regsvr32.exe 81 PID 4700 wrote to memory of 4104 4700 regsvr32.exe 83 PID 4700 wrote to memory of 4104 4700 regsvr32.exe 83 PID 4700 wrote to memory of 4104 4700 regsvr32.exe 83 PID 4700 wrote to memory of 4104 4700 regsvr32.exe 83 PID 4700 wrote to memory of 4104 4700 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\tidbit.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\publish\tidbit.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-