Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
Contract.lnk
windows7-x64
3Contract.lnk
windows10-2004-x64
3publish/po...ra.vbs
windows7-x64
3publish/po...ra.vbs
windows10-2004-x64
1publish/respiring.dll
windows7-x64
10publish/respiring.dll
windows10-2004-x64
10publish/un...ty.cmd
windows7-x64
1publish/un...ty.cmd
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
publish/popperSumatra.vbs
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
publish/popperSumatra.vbs
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
publish/respiring.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
publish/respiring.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
publish/underdoVindictability.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
publish/underdoVindictability.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
publish/respiring.dll
-
Size
537KB
-
MD5
c519f8bd60844e7ea776e67a4b724e53
-
SHA1
c699b16ce036b50997a52114280a080d16bf5599
-
SHA256
e91f4205e8fa14ac9acd4b6cf9a54e2fa8b3901e619e18b3fa22188ef1ddeaff
-
SHA512
f28385fd7284a7395565150990ed068c143011cccc7944f0097531503a8bc62c6386299f92bd8093ed384eaec5ce327e8c75534073bf03c8f78f5bfc40dd5ca9
-
SSDEEP
12288:P9hOiDHnsfkmEsrq1ZBr0fvpdgJvLrG3q8/UxPVN:lPT1HsuPr+hdIO3kVN
Malware Config
Extracted
qakbot
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2524 regsvr32.exe 2524 regsvr32.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe 5072 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2524 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3364 wrote to memory of 2524 3364 regsvr32.exe 81 PID 3364 wrote to memory of 2524 3364 regsvr32.exe 81 PID 3364 wrote to memory of 2524 3364 regsvr32.exe 81 PID 2524 wrote to memory of 5072 2524 regsvr32.exe 82 PID 2524 wrote to memory of 5072 2524 regsvr32.exe 82 PID 2524 wrote to memory of 5072 2524 regsvr32.exe 82 PID 2524 wrote to memory of 5072 2524 regsvr32.exe 82 PID 2524 wrote to memory of 5072 2524 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\respiring.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\publish\respiring.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-