Behavioral task
behavioral1
Sample
1416-57-0x0000000000170000-0x0000000000192000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1416-57-0x0000000000170000-0x0000000000192000-memory.dll
Resource
win10v2004-20220812-en
General
-
Target
1416-57-0x0000000000170000-0x0000000000192000-memory.dmp
-
Size
136KB
-
MD5
6cc7f89086e6178990026b537f7ea684
-
SHA1
12bd49183d9a380b2968d4c23a9f3942bcfe1cfc
-
SHA256
eb1f2f5bc87e7eba16e9e725c4f6ad5656b31549fa480a52eb077ff85be7cf57
-
SHA512
b0185093862871ba48bd75412e957c9ba45d7471453fbc5faa2196296a418a9d8fb0fa6cb622bda989850f3befda1906e3e49368d9d4dafbdf05e41e72650762
-
SSDEEP
3072:kf0SYtA9nahTpwx+CRA4vJkE96MTBfNwYiH:kf39ahTpwta4vJn96MTBlDiH
Malware Config
Extracted
qakbot
78.94.148.92:1753
134.180.185.240:32987
201.136.101.182:38323
124.77.95.5:46163
196.90.29.190:30693
187.144.110.117:36330
10.44.33.140:65267
162.117.200.91:29984
159.254.223.192:31154
11.239.81.233:37
31.248.76.23:24072
224.77.182.18:55579
124.230.27.11:44408
205.255.39.94:54675
192.1.213.104:14212
145.3.120.239:20068
242.199.30.106:9157
243.240.195.106:42825
74.234.32.185:42698
102.51.5.67:47820
43.190.241.127:50708
29.119.168.182:51370
54.106.172.208:21101
76.55.174.209:2746
71.182.193.130:5327
111.143.132.167:9985
173.210.161.232:27188
22.155.219.162:29117
167.159.67.2:42455
80.214.112.151:9618
75.86.4.24:35165
106.146.239.56:49679
194.127.196.112:59762
64.184.233.29:48193
218.86.11.123:62100
108.87.254.103:36138
240.129.151.227:4400
96.117.66.72:0
48.220.224.248:32917
240.164.22.246:57048
224.87.85.180:40164
214.9.213.13:12523
117.180.92.184:46633
73.23.253.56:17393
162.74.55.118:4571
9.252.189.253:60714
101.200.152.191:46287
110.117.95.0:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot family
Files
-
1416-57-0x0000000000170000-0x0000000000192000-memory.dmp.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ