Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/checksumming.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/checksumming.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/leas.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
disallowable/leas.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
disallowable/checksumming.dll
-
Size
422KB
-
MD5
c53e389854cbcd9f97dac228f8a957cb
-
SHA1
bce5dd0660e6efc5717d1c5dd3d54a9a56af1fb2
-
SHA256
3803603fb026a2d58d21da04c47a8a0052d725a0d6fb3e8f8ab40099b04c24bc
-
SHA512
8fc400fa6c8bbf1d4a6a26c5df3235d9b136cc1f3fe54082b07d17cb1f732f03b41aea516084cdb16415488c003a3f45ceb6df1fe6aa0a10ca579c0930fb5d80
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNjso8Ywr6t57AKC:eqdclafl4eGXuiN38Ye6c
Malware Config
Extracted
qakbot
404.2
BB04
1666863946
27.110.134.202:995
1.156.220.47:17155
186.188.80.134:443
1.190.199.101:9480
187.1.1.181:42178
118.200.83.226:443
187.0.1.144:51727
193.3.19.137:443
1.201.68.209:12157
188.49.56.189:443
187.0.1.14:58271
190.74.248.136:443
201.210.92.3:2222
187.0.1.105:40325
64.123.103.123:443
41.97.169.44:443
72.88.245.71:443
187.0.1.45:59049
41.100.163.127:443
187.0.1.83:62527
175.205.2.54:443
187.0.1.201:63844
71.199.168.185:443
187.0.1.105:40278
186.18.210.16:443
101.109.44.197:995
187.0.1.181:11298
24.177.111.153:443
184.159.76.47:443
187.0.1.105:39831
93.156.96.171:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1748 regsvr32.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe 1360 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1748 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1492 wrote to memory of 1748 1492 regsvr32.exe 27 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28 PID 1748 wrote to memory of 1360 1748 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\checksumming.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\checksumming.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1360
-
-