Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
27/10/2022, 15:26
General
-
Target
alphabetical/unperched.dll
-
Size
627KB
-
MD5
cba1ea7fd2999c09a57ab80ec61a366c
-
SHA1
ed15bd41dec1f7628be89adff8995242d5281e69
-
SHA256
d0232586a1421eb851d5817a55fd1afa68a0392cc94689b5af3ae093f18ef823
-
SHA512
12251a0cb3f93a098a12cb3f78a439c98d67465f68c5151f18c2692ba5331deb34e74723b201f8b7e85dcb2027db55ec6681890baeb70cb142979a9ef652b65c
-
SSDEEP
12288:cx8IFmbH8yS5XXUrIVcxxUnMnwldJOCP6HcD5q:x6y8bRZAuM6dMCSHc4
Malware Config
Extracted
qakbot
403.1051
BB04
1666776497
197.204.53.242:443
83.244.63.21:443
27.110.134.202:995
173.49.74.62:443
181.164.194.228:443
24.116.45.121:443
41.47.249.185:443
24.206.27.39:443
113.183.223.8:443
186.188.80.134:443
64.207.237.118:443
156.216.134.70:995
58.247.115.126:995
180.151.116.67:443
41.140.63.187:443
144.202.15.58:443
190.199.97.108:993
172.117.139.142:995
45.230.169.132:995
24.9.220.167:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\alphabetical\unperched.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\alphabetical\unperched.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7203⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
164KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
164KB