Analysis
-
max time kernel
186s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
DV_7727.iso
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
DV_7727.iso
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
DV.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
DV.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
selectable/jagged.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
selectable/jagged.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
selectable/outstaying.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
selectable/outstaying.dll
-
Size
421KB
-
MD5
4f65cf53d8d47db9b7af0b66ec131052
-
SHA1
92fe338c650338d91546eff91ec5b272a9ac2565
-
SHA256
68497fe4d9c25c38e9419c4d617a62fedbbe272ef2623c6d61d6794fb047338a
-
SHA512
27e1cfa5e97a13c13c35f817c3163847150f1aadb256708017e6f2b9b5d1bb65368795665a44e6433004974a13420a272ed758341a9ed367c0b7070e6db6d041
-
SSDEEP
6144:MkbHJhzU/Gr+acU2gqnEIzGOEBPepzn6WX1LB5QpK1K0we5itwWUTDAO7V:dheLacnx5dFBOpawe5iFw1V
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4188 regsvr32.exe 4188 regsvr32.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe 4156 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4188 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3060 wrote to memory of 4188 3060 regsvr32.exe 80 PID 3060 wrote to memory of 4188 3060 regsvr32.exe 80 PID 3060 wrote to memory of 4188 3060 regsvr32.exe 80 PID 4188 wrote to memory of 4156 4188 regsvr32.exe 81 PID 4188 wrote to memory of 4156 4188 regsvr32.exe 81 PID 4188 wrote to memory of 4156 4188 regsvr32.exe 81 PID 4188 wrote to memory of 4156 4188 regsvr32.exe 81 PID 4188 wrote to memory of 4156 4188 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\selectable\outstaying.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\selectable\outstaying.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-