Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
Contract.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Contract.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
liveried/sufferer.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
liveried/sufferer.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
liveried/waddling.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
liveried/waddling.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
liveried/sufferer.dll
-
Size
635KB
-
MD5
93abfce1ae568066c23b308f58e1c42c
-
SHA1
89d62453e3c9672171107246828667195852213a
-
SHA256
72a39e72f4034223b2f51411424333bbf88f9e60cdb91494281eefa006416928
-
SHA512
e7906b73155c861697a6aaf121b4238f574b6c4535614a0fc0e6c90e9513988733e4748988c013bbf9440d49a2c6eaf246df7bb0df19d21204f99ae7f448d424
-
SSDEEP
12288:Z5zUU6VCu0L4yCLtaNExGapWYKv38dy9XRHPh3M4B90U6Zt:fQhVCPnCoApOv3q2hxM4BKZ
Malware Config
Extracted
qakbot
403.1051
BB04
1666265103
102.156.82.38:995
152.170.17.136:443
216.131.22.236:995
70.173.248.13:443
14.246.151.175:443
160.179.32.101:995
118.175.242.26:995
186.188.80.202:443
41.69.181.145:443
156.220.14.160:993
201.68.209.47:32101
206.1.172.1:443
156.217.185.90:995
190.74.4.20:443
217.78.49.161:443
154.181.199.80:995
200.233.108.153:993
175.205.2.54:443
198.2.51.242:993
181.164.194.228:443
197.204.180.90:443
201.210.121.49:2222
144.202.15.58:443
41.228.249.243:995
200.155.61.245:995
45.230.169.132:995
197.206.119.7:443
193.3.19.137:443
41.105.5.123:443
103.156.237.170:443
73.96.24.39:443
201.210.119.28:993
136.232.184.134:995
105.105.0.165:443
190.193.180.228:443
190.204.101.210:2222
190.33.87.140:443
200.93.11.28:2222
181.56.171.3:995
181.168.145.94:443
94.36.5.31:443
5.163.177.234:443
167.58.254.85:443
191.84.67.34:443
41.99.101.231:443
206.1.233.138:443
58.186.75.42:443
206.1.181.103:443
181.141.3.126:443
187.143.131.190:2222
82.12.196.197:443
200.44.222.59:2222
105.99.146.94:443
187.198.16.39:443
197.2.227.65:443
201.171.199.216:443
105.108.252.186:443
186.213.214.13:2222
85.242.200.96:443
41.97.228.210:443
105.158.71.149:443
41.62.218.170:443
105.103.39.73:443
206.1.233.162:2087
190.203.116.63:2222
152.171.41.171:443
78.179.135.247:443
41.141.216.137:995
200.155.61.245:443
167.58.86.35:995
105.96.250.243:443
189.110.3.60:2222
41.100.121.175:443
41.143.221.72:443
41.111.121.4:995
160.177.88.185:443
41.100.94.61:443
72.88.245.71:443
41.101.153.206:443
41.103.68.151:443
177.152.65.142:443
42.116.54.220:443
181.197.41.173:443
160.177.145.229:443
179.105.126.196:995
2.152.181.194:995
125.26.173.239:443
31.166.182.166:443
196.65.219.83:443
220.134.54.185:2222
202.5.53.143:443
74.141.38.107:443
78.184.31.100:443
41.104.28.115:995
68.35.151.16:443
149.126.159.254:443
109.49.47.10:80
134.35.1.15:443
220.123.29.76:443
201.223.175.208:32100
190.33.241.216:443
201.205.130.251:995
216.131.22.236:443
75.157.229.63:443
163.182.177.80:443
201.212.173.78:443
186.93.143.86:2222
106.243.197.122:443
186.188.96.197:443
181.55.106.237:443
45.184.179.188:2222
88.229.17.133:443
104.237.6.167:443
102.185.146.113:995
186.144.129.196:443
186.48.244.74:443
190.24.54.187:995
186.177.93.18:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1124 rundll32.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe 696 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1124 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1492 wrote to memory of 1124 1492 rundll32.exe 27 PID 1124 wrote to memory of 696 1124 rundll32.exe 28 PID 1124 wrote to memory of 696 1124 rundll32.exe 28 PID 1124 wrote to memory of 696 1124 rundll32.exe 28 PID 1124 wrote to memory of 696 1124 rundll32.exe 28 PID 1124 wrote to memory of 696 1124 rundll32.exe 28 PID 1124 wrote to memory of 696 1124 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\liveried\sufferer.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\liveried\sufferer.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:696
-
-