Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
benin.dat.3.dll
Resource
win7-20220901-en
General
-
Target
benin.dat.3.dll
-
Size
422KB
-
MD5
a2714f8819c1f7d8609f3e82b8e1d531
-
SHA1
dd69500de27704000dced76bafed8bcac859b6ea
-
SHA256
9d0e9183b88823f5a401ef5cc0f32fd47f7a8270073acc8ec1baf5abfe4fd104
-
SHA512
cdc2210e31fd0871f8289ae09d1666a68f26cd6719c0eec43effdc34d4873c2ce332bf68d37022e0dca4459113e06c27460244fc9250fc6d8f42777f484bfe64
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNj6o8Ywr6t57AKC:eqdclafl4eGXuiNp8Ye6c
Malware Config
Extracted
qakbot
404.2
BB04
1666863946
27.110.134.202:995
1.156.220.47:17155
186.188.80.134:443
1.190.199.101:9480
187.1.1.181:42178
118.200.83.226:443
187.0.1.144:51727
193.3.19.137:443
1.201.68.209:12157
188.49.56.189:443
187.0.1.14:58271
190.74.248.136:443
201.210.92.3:2222
187.0.1.105:40325
64.123.103.123:443
41.97.169.44:443
72.88.245.71:443
187.0.1.45:59049
41.100.163.127:443
187.0.1.83:62527
175.205.2.54:443
187.0.1.201:63844
71.199.168.185:443
187.0.1.105:40278
186.18.210.16:443
101.109.44.197:995
187.0.1.181:11298
24.177.111.153:443
184.159.76.47:443
187.0.1.105:39831
93.156.96.171:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Extracted
qakbot
-
salt
�Ku���s�-�6��=RH��L�ۓZ6פQ�~�O�^-t�c8e���PA�F*��\S��a ~�)/�Ƚ�6Rju��Y�d����E�̠�E��:�w 5�� �m��N��Ӿ�[V� <W1��7 Y7�Az�h�NN�}��9� �r�[�N�"��{��u9�����X"�t���x�� ����<�-|����44�'xJζ�,�$�)3��$k-ӥi�,�n��趟�����ÏKF �:J�e6cl-u2f�~+��ٌc�6����9��}�*���s�0d���Ι�l�����D�������{)a��A2
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 regsvr32.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 824 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 1380 wrote to memory of 824 1380 regsvr32.exe 27 PID 824 wrote to memory of 1780 824 regsvr32.exe 28 PID 824 wrote to memory of 1780 824 regsvr32.exe 28 PID 824 wrote to memory of 1780 824 regsvr32.exe 28 PID 824 wrote to memory of 1780 824 regsvr32.exe 28 PID 824 wrote to memory of 1780 824 regsvr32.exe 28 PID 824 wrote to memory of 1780 824 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-