Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/missives.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/missives.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/unstrap.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
disallowable/unstrap.dll
-
Size
422KB
-
MD5
a989f5efe8fa1653bb98b7c2265900af
-
SHA1
f5925cf7d38626d13694ef180e811f25ae583cf6
-
SHA256
5679c1eedb7d456cd5dd32cba5bed141787d354a384f4961f16bd96eb2ea383b
-
SHA512
b8af781775c310ae4442d6d3f766b86e196da277e3ed1496e47d2103f469c42f4d74df917811cc505eb1c9ff3063ceee5257041ebd3018ce27260d85cef62c0c
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNjqo8Ywr6t57AKC:eqdclafl4eGXuiNZ8Ye6c
Malware Config
Extracted
qakbot
404.2
BB04
1666863946
27.110.134.202:995
1.156.220.47:17155
186.188.80.134:443
1.190.199.101:9480
187.1.1.181:42178
118.200.83.226:443
187.0.1.144:51727
193.3.19.137:443
1.201.68.209:12157
188.49.56.189:443
187.0.1.14:58271
190.74.248.136:443
201.210.92.3:2222
187.0.1.105:40325
64.123.103.123:443
41.97.169.44:443
72.88.245.71:443
187.0.1.45:59049
41.100.163.127:443
187.0.1.83:62527
175.205.2.54:443
187.0.1.201:63844
71.199.168.185:443
187.0.1.105:40278
186.18.210.16:443
101.109.44.197:995
187.0.1.181:11298
24.177.111.153:443
184.159.76.47:443
187.0.1.105:39831
93.156.96.171:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5068 regsvr32.exe 5068 regsvr32.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe 4796 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5068 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1680 wrote to memory of 5068 1680 regsvr32.exe 80 PID 1680 wrote to memory of 5068 1680 regsvr32.exe 80 PID 1680 wrote to memory of 5068 1680 regsvr32.exe 80 PID 5068 wrote to memory of 4796 5068 regsvr32.exe 81 PID 5068 wrote to memory of 4796 5068 regsvr32.exe 81 PID 5068 wrote to memory of 4796 5068 regsvr32.exe 81 PID 5068 wrote to memory of 4796 5068 regsvr32.exe 81 PID 5068 wrote to memory of 4796 5068 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\unstrap.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\unstrap.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-