Analysis
-
max time kernel
601s -
max time network
621s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 19:13
Static task
static1
Behavioral task
behavioral1
Sample
Cancellation.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Cancellation.lnk
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
inexhaustive/automatics.cmd
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
inexhaustive/automatics.cmd
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
inexhaustive/illustriousness.dll
Resource
win7-20220812-en
General
-
Target
inexhaustive/illustriousness.dll
-
Size
420KB
-
MD5
dd81abd364fd77a34d406fb209ef37ff
-
SHA1
4a6d6c9348cb3e77ed2d5195833f437b7c2f08d2
-
SHA256
22c6e84683cba9e8bfffc7453a33fbf7611e9c6c48f5fb088f0a21912c2b23a0
-
SHA512
11027ac2c89ebb053b648b5bed6019bc7716e0ce7073071da6e32046a08a6a744f40f325a23a096ace6af06821413395f073c32030aab4842e0af1c0dd9d32fc
-
SSDEEP
6144:5MVSKlGqB/JXPX+cLBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcRkq/GNU1E1T5Hb1
Malware Config
Extracted
qakbot
403.1051
obama217
1666765529
197.204.53.242:443
105.106.60.149:443
102.159.110.79:995
64.207.237.118:443
156.216.134.70:995
180.151.116.67:443
190.199.97.108:993
206.1.203.0:443
186.188.96.197:443
206.1.128.203:443
201.249.100.208:995
190.75.151.66:2222
198.2.51.242:993
90.165.109.4:2222
71.199.168.185:443
181.56.171.3:995
43.241.159.148:443
41.103.1.16:443
24.207.97.117:443
105.157.86.118:443
201.223.169.238:32100
47.14.229.4:443
70.60.142.214:2222
41.47.249.185:443
142.181.183.42:2222
41.62.165.152:443
41.97.205.96:443
41.97.14.60:443
151.213.183.141:995
75.84.234.68:443
186.18.210.16:443
41.96.204.196:443
64.123.103.123:443
186.48.174.77:995
152.170.17.136:443
160.176.151.70:995
78.179.135.247:443
191.33.187.192:2222
41.140.63.187:443
98.207.190.55:443
196.65.217.253:995
78.50.124.220:443
91.171.72.214:32100
186.154.189.162:995
101.109.44.197:995
97.92.4.205:8443
41.36.159.36:993
70.115.104.126:443
181.44.34.172:443
88.240.75.201:443
113.162.196.232:443
156.197.230.148:995
24.130.228.100:443
41.109.228.108:995
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
190.203.51.133:2222
96.46.230.10:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.108.133.151:443
41.104.155.245:443
65.140.11.170:443
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
41.101.193.38:443
105.155.151.29:995
196.207.146.151:443
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
186.18.77.99:443
41.107.78.169:443
149.126.159.224:443
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.199.156:2087
102.156.162.83:443
220.134.54.185:2222
88.132.109.147:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.142.102:443
190.203.106.109:2222
200.155.61.245:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 1368 regsvr32.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe 1248 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1368 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1712 wrote to memory of 1368 1712 regsvr32.exe regsvr32.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe PID 1368 wrote to memory of 1248 1368 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\inexhaustive\illustriousness.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\inexhaustive\illustriousness.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-61-0x0000000000000000-mapping.dmp
-
memory/1248-64-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1248-65-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1368-55-0x0000000000000000-mapping.dmp
-
memory/1368-56-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1368-58-0x0000000000410000-0x0000000000439000-memory.dmpFilesize
164KB
-
memory/1368-57-0x0000000000410000-0x0000000000439000-memory.dmpFilesize
164KB
-
memory/1368-59-0x00000000001A0000-0x00000000001CB000-memory.dmpFilesize
172KB
-
memory/1368-60-0x0000000000410000-0x0000000000490000-memory.dmpFilesize
512KB
-
memory/1368-63-0x0000000000410000-0x0000000000439000-memory.dmpFilesize
164KB
-
memory/1712-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB