Analysis
-
max time kernel
191s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
illustriousness.dat.dll
Resource
win7-20220812-en
General
-
Target
illustriousness.dat.dll
-
Size
420KB
-
MD5
dd81abd364fd77a34d406fb209ef37ff
-
SHA1
4a6d6c9348cb3e77ed2d5195833f437b7c2f08d2
-
SHA256
22c6e84683cba9e8bfffc7453a33fbf7611e9c6c48f5fb088f0a21912c2b23a0
-
SHA512
11027ac2c89ebb053b648b5bed6019bc7716e0ce7073071da6e32046a08a6a744f40f325a23a096ace6af06821413395f073c32030aab4842e0af1c0dd9d32fc
-
SSDEEP
6144:5MVSKlGqB/JXPX+cLBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcRkq/GNU1E1T5Hb1
Malware Config
Extracted
qakbot
403.1051
obama217
1666765529
197.204.53.242:443
105.106.60.149:443
102.159.110.79:995
64.207.237.118:443
156.216.134.70:995
180.151.116.67:443
190.199.97.108:993
206.1.203.0:443
186.188.96.197:443
206.1.128.203:443
201.249.100.208:995
190.75.151.66:2222
198.2.51.242:993
90.165.109.4:2222
71.199.168.185:443
181.56.171.3:995
43.241.159.148:443
41.103.1.16:443
24.207.97.117:443
105.157.86.118:443
201.223.169.238:32100
47.14.229.4:443
70.60.142.214:2222
41.47.249.185:443
142.181.183.42:2222
41.62.165.152:443
41.97.205.96:443
41.97.14.60:443
151.213.183.141:995
75.84.234.68:443
186.18.210.16:443
41.96.204.196:443
64.123.103.123:443
186.48.174.77:995
152.170.17.136:443
160.176.151.70:995
78.179.135.247:443
191.33.187.192:2222
41.140.63.187:443
98.207.190.55:443
196.65.217.253:995
78.50.124.220:443
91.171.72.214:32100
186.154.189.162:995
101.109.44.197:995
97.92.4.205:8443
41.36.159.36:993
70.115.104.126:443
181.44.34.172:443
88.240.75.201:443
113.162.196.232:443
156.197.230.148:995
24.130.228.100:443
41.109.228.108:995
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
190.203.51.133:2222
96.46.230.10:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.108.133.151:443
41.104.155.245:443
65.140.11.170:443
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
41.101.193.38:443
105.155.151.29:995
196.207.146.151:443
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
186.18.77.99:443
41.107.78.169:443
149.126.159.224:443
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.199.156:2087
102.156.162.83:443
220.134.54.185:2222
88.132.109.147:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.142.102:443
190.203.106.109:2222
200.155.61.245:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 5112 regsvr32.exe 5112 regsvr32.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe 2812 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 5112 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 3628 wrote to memory of 5112 3628 regsvr32.exe regsvr32.exe PID 3628 wrote to memory of 5112 3628 regsvr32.exe regsvr32.exe PID 3628 wrote to memory of 5112 3628 regsvr32.exe regsvr32.exe PID 5112 wrote to memory of 2812 5112 regsvr32.exe wermgr.exe PID 5112 wrote to memory of 2812 5112 regsvr32.exe wermgr.exe PID 5112 wrote to memory of 2812 5112 regsvr32.exe wermgr.exe PID 5112 wrote to memory of 2812 5112 regsvr32.exe wermgr.exe PID 5112 wrote to memory of 2812 5112 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\illustriousness.dat.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\illustriousness.dat.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2812-136-0x0000000000000000-mapping.dmp
-
memory/2812-138-0x0000000000B80000-0x0000000000BA9000-memory.dmpFilesize
164KB
-
memory/2812-139-0x0000000000B80000-0x0000000000BA9000-memory.dmpFilesize
164KB
-
memory/5112-133-0x0000000000000000-mapping.dmp
-
memory/5112-134-0x00000000008D0000-0x00000000008FB000-memory.dmpFilesize
172KB
-
memory/5112-135-0x0000000000AB0000-0x0000000000AD9000-memory.dmpFilesize
164KB
-
memory/5112-137-0x0000000000AB0000-0x0000000000AD9000-memory.dmpFilesize
164KB