Analysis
-
max time kernel
300s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2022, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
6438/2240.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
6438/jeopardizes.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Overdue.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
6438/jeopardizes.dll
-
Size
386KB
-
MD5
5c9ada08bd83cd885f7d9aed0c498b77
-
SHA1
311076e76abfdc7bcfe0bb46740e4c7e9e71b3dd
-
SHA256
e6fccbd534ed2d3e60263b7fd1611b4cbaca6a1ebc68b8210a57cb1f3de519ca
-
SHA512
fedf070e05d00cb1e26a6bbdf25afe15f6e6008e47df572df5b6141410f994ebd704b3c98c9219fa43ada0365f5961f02f82162c780c8d8cc08a89e07cec610c
-
SSDEEP
6144:XtgTFlqteWTBa5WsoUReNsyLK9p8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN9KtniPHlQEFYM
Malware Config
Extracted
qakbot
78.94.148.92:1753
134.180.185.240:32987
201.136.101.182:38323
124.77.95.5:46163
196.90.29.190:30693
187.144.110.117:36330
10.44.33.140:65267
162.117.200.91:29984
159.254.223.192:31154
11.239.81.233:37
31.248.76.23:24072
224.77.182.18:55579
124.230.27.11:44408
205.255.39.94:54675
192.1.213.104:14212
145.3.120.239:20068
242.199.30.106:9157
243.240.195.106:42825
74.234.32.185:42698
102.51.5.67:47820
43.190.241.127:50708
29.119.168.182:51370
54.106.172.208:21101
76.55.174.209:2746
71.182.193.130:5327
111.143.132.167:9985
173.210.161.232:27188
22.155.219.162:29117
167.159.67.2:42455
80.214.112.151:9618
75.86.4.24:35165
106.146.239.56:49679
194.127.196.112:59762
64.184.233.29:48193
218.86.11.123:62100
108.87.254.103:36138
240.129.151.227:4400
96.117.66.72:0
48.220.224.248:32917
240.164.22.246:57048
224.87.85.180:40164
214.9.213.13:12523
117.180.92.184:46633
73.23.253.56:17393
162.74.55.118:4571
9.252.189.253:60714
101.200.152.191:46287
110.117.95.0:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 regsvr32.exe 4172 regsvr32.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe 4544 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4172 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4172 4896 regsvr32.exe 81 PID 4896 wrote to memory of 4172 4896 regsvr32.exe 81 PID 4896 wrote to memory of 4172 4896 regsvr32.exe 81 PID 4172 wrote to memory of 4544 4172 regsvr32.exe 85 PID 4172 wrote to memory of 4544 4172 regsvr32.exe 85 PID 4172 wrote to memory of 4544 4172 regsvr32.exe 85 PID 4172 wrote to memory of 4544 4172 regsvr32.exe 85 PID 4172 wrote to memory of 4544 4172 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6438\jeopardizes.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6438\jeopardizes.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-