Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
Calculation.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Calculation.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
vertices/asteroidal.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
vertices/asteroidal.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
vertices/bombshell.dll
Resource
win7-20220901-en
windows7-x64
General
-
Target
vertices/bombshell.dll
-
Size
584KB
-
MD5
b4426d8399bf54e510aeceb59c53af19
-
SHA1
1c140f009f27988fb4a81fda0889cafa1e207888
-
SHA256
e9388e0fbca331b26d097235a83ec3792c97ee6258683978477b1f1c86d458f2
-
SHA512
e65523fa2e91aafa9d9015a3ba7c43372712320349da47e4870006059ee9f3c6bdbdd04adb0756e3d8dc754dfe27d144a7fa7e69f102f73a3f505210cb78de34
-
SSDEEP
12288:HZBs6eUwpkdFC7dStewcZWOcRerXugaJJkPcpF:5+UwWFew2D8k
Malware Config
Extracted
qakbot
403.973
obama214
1666019778
105.96.221.136:443
37.37.80.2:3389
105.154.56.232:995
41.107.116.19:443
105.103.52.189:443
159.192.204.135:443
41.107.58.251:443
177.152.65.142:443
102.47.218.41:443
176.45.35.243:443
70.173.248.13:443
102.159.77.134:995
220.123.29.76:443
82.12.196.197:443
103.156.237.71:443
149.126.159.254:443
176.44.119.153:443
181.56.171.3:995
190.205.229.67:2222
151.251.50.117:443
163.182.177.80:443
72.21.109.1:443
41.101.92.195:443
190.193.180.228:443
190.204.112.207:2222
41.97.56.102:443
41.69.209.76:443
190.78.89.157:993
206.1.216.19:2087
85.242.200.96:443
41.251.219.50:443
105.111.141.73:443
41.103.64.82:443
190.39.218.17:443
84.220.13.28:443
190.100.149.122:995
197.1.19.60:443
196.64.70.216:443
196.89.213.40:995
181.168.145.94:443
187.101.200.186:995
41.105.245.174:443
179.25.144.177:995
78.179.135.247:443
94.52.127.44:443
186.18.210.16:443
102.158.215.180:443
78.183.238.79:443
197.1.50.150:443
42.189.32.186:80
167.58.235.5:443
14.54.83.15:443
187.198.8.241:443
71.239.12.136:443
112.70.141.221:443
37.245.136.135:2222
88.232.10.69:443
41.98.250.65:443
82.205.9.34:443
196.64.239.75:443
37.8.68.1:443
197.1.248.244:443
197.2.139.7:443
79.45.134.162:22
182.183.211.163:995
154.246.14.94:443
144.86.17.168:443
182.185.29.69:995
160.177.47.116:6881
181.197.41.173:443
160.248.194.147:443
85.109.221.97:443
125.25.77.249:995
1.20.185.138:443
91.171.72.214:32100
197.10.195.7:443
45.160.33.163:443
202.170.206.61:995
96.9.66.118:995
132.251.244.227:443
113.188.13.246:443
78.181.39.116:443
1.53.101.75:443
197.202.173.111:443
31.201.40.194:443
197.116.178.224:443
79.155.159.177:443
181.188.164.123:443
156.221.50.226:995
41.251.15.7:990
45.240.140.233:995
102.188.91.158:995
189.243.187.76:443
179.105.182.216:995
196.65.230.248:995
181.141.3.126:443
128.234.26.174:995
78.161.194.147:443
78.101.177.210:443
86.217.167.235:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1748 regsvr32.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1748 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28 PID 1748 wrote to memory of 696 1748 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\vertices\bombshell.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\vertices\bombshell.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:696
-
-