Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
fd18b58235e50379b775cc3cbabdc8df599e71f787b2d286281999c24ecc18f8.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
fd18b58235e50379b775cc3cbabdc8df599e71f787b2d286281999c24ecc18f8.dll
-
Size
384KB
-
MD5
1fa2068f08d1c55f06d6c33cb846f9ad
-
SHA1
e305efe7987be1a91cdf39daa6bd1b19bc8c694c
-
SHA256
fd18b58235e50379b775cc3cbabdc8df599e71f787b2d286281999c24ecc18f8
-
SHA512
c2a2b84e2549be4078397650470f40d7f1b3c7385eab182e91ee2af09aea429c307b778d16e7b5673a10946485ef1db790d21878a4f752ed59e3061687898764
-
SSDEEP
6144:OwWNVNYHWRZMZeiVt5p682MkWgylrBeKd5bYBWzjCvIuwDJnpCKHbrxOG53KPNs:Ol5eWt82Mk6lroKsLguiHOPNs
Malware Config
Extracted
qakbot
403.914
BB
1665048878
6.214.34.86:37718
181.164.194.228:443
197.158.89.85:443
14.230.199.98:443
105.101.23.180:443
41.104.205.128:443
134.35.6.76:443
197.202.163.4:443
105.159.124.224:443
41.96.33.236:443
181.141.3.126:443
163.182.177.80:443
41.248.72.229:8443
41.100.62.129:443
68.83.169.91:443
190.29.228.61:443
160.176.249.11:995
41.107.54.99:443
94.52.127.44:443
105.69.155.85:995
45.227.251.167:2222
197.206.141.97:443
149.126.159.254:443
181.44.34.172:443
81.184.181.215:443
148.213.109.165:995
105.111.44.93:443
42.189.12.36:80
72.88.245.71:443
181.114.169.156:443
98.143.70.147:2222
197.94.70.41:443
197.11.134.255:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 regsvr32.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe 1744 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1984 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 2000 wrote to memory of 1984 2000 regsvr32.exe 26 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27 PID 1984 wrote to memory of 1744 1984 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd18b58235e50379b775cc3cbabdc8df599e71f787b2d286281999c24ecc18f8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fd18b58235e50379b775cc3cbabdc8df599e71f787b2d286281999c24ecc18f8.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1744
-
-