Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2022 16:15
Static task
static1
Behavioral task
behavioral1
Sample
IData.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
IData.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
obediences/bide.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
obediences/bide.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
obediences/salient.dll
Resource
win7-20220901-en
windows7-x64
General
-
Target
obediences/salient.dll
-
Size
295KB
-
MD5
11c4d79864a389a5400a92fbc4b3e80a
-
SHA1
e299a44aa3dbebfe62410ff5fda226d1d3f74ef2
-
SHA256
57108d6e8e86f1a416f5ac44ccd49f2b58cbc9e3995fc35fec4a43fd700fa39e
-
SHA512
4862ac69e86ca1293886081546f9d3cec9f20dc495081fe6aaea418502ef223b673c588a46b0609b93180e8682f91a56e8f0435e2c6c8c61e229fc360939f639
-
SSDEEP
6144:YiSz8ZFZG2MEnD4vrWEBvljmcmUv9n2dDSH+:DS4HMmQWEBvlaUqSH+
Malware Config
Extracted
qakbot
403.973
BB01
1665647855
19.168.189.106:26139
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4056 regsvr32.exe 4056 regsvr32.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe 4724 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4056 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4376 wrote to memory of 4056 4376 regsvr32.exe 82 PID 4376 wrote to memory of 4056 4376 regsvr32.exe 82 PID 4376 wrote to memory of 4056 4376 regsvr32.exe 82 PID 4056 wrote to memory of 4724 4056 regsvr32.exe 84 PID 4056 wrote to memory of 4724 4056 regsvr32.exe 84 PID 4056 wrote to memory of 4724 4056 regsvr32.exe 84 PID 4056 wrote to memory of 4724 4056 regsvr32.exe 84 PID 4056 wrote to memory of 4724 4056 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\obediences\salient.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\obediences\salient.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-