Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31-10-2022 07:39
Static task
static1
Behavioral task
behavioral1
Sample
mal.dll
Resource
win7-20220812-en
General
-
Target
mal.dll
-
Size
628KB
-
MD5
0b027723b5af33dad8219cbdcd44ad9a
-
SHA1
b2243901845b163db104ec790b983222f0691a94
-
SHA256
cb5b8365be065ab9870b15a524decf7474575b0b14e796ee77d6f482dfb6d53c
-
SHA512
82bdeb901957d45f9d72705863a3599fdbc57fc0ce2f3c5cd191e47ab754bd899715d290c189a512d0fcb804c6ec3cfe9cef3cb496a45e4eff54b74d1a29692e
-
SSDEEP
12288:8x8IFmbH8yS5XXUrIVcxxn/5IOT2LY/O9bBoY//w:R6y8bRZARhI/LoO9bBoY/4
Malware Config
Extracted
qakbot
404.2
obama218
1666870886
24.206.27.39:443
1.102.156.146:8707
187.1.1.118:44751
172.117.139.142:995
1.181.118.183:31745
45.35.97.45:443
187.0.1.27:28294
58.247.115.126:995
1.24.9.220:42753
187.1.1.186:48208
112.141.184.246:995
201.223.169.238:32100
68.62.199.70:443
45.49.137.80:443
187.0.1.172:28709
102.159.236.29:443
183.242.1.187:1
186.48.161.130:995
191.33.187.192:2222
154.181.228.27:995
90.165.109.4:2222
187.0.1.24:53089
41.97.205.96:443
187.0.1.160:45207
91.171.72.214:32100
187.0.1.181:11298
24.177.111.153:443
184.159.76.47:443
187.0.1.105:39831
93.156.96.171:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1728 rundll32.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe 1532 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1728 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1812 wrote to memory of 1728 1812 rundll32.exe 28 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29 PID 1728 wrote to memory of 1532 1728 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mal.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mal.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-