Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/10/2022, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
CO.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
CO.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
judicature/contaminative.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
judicature/contaminative.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
judicature/lent.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
judicature/lent.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
judicature/contaminative.dll
-
Size
1.6MB
-
MD5
7e7bdad13f25974c9bd07b0591d2773e
-
SHA1
fd0d969841ec7654b1b969d8c296031c3575d63c
-
SHA256
e9e65452644cf71bddbd3a324c171117c3df219a642bca6083ee6796dc5365c2
-
SHA512
a7f3e3e0c8c3d07993694a30e7853d81ae97417d17ec93287cd9a5da30a305dbfad5a79b5431d599581ba05aa8d0b0b58dea88a61b20031294aaa32ee9038a82
-
SSDEEP
24576:hdOBKJGDcYOGm+FpvC04Rl3ZC499TlgxE29S3GrOk8YdSkQh:hs9dm+n60YZCZY3+R8Ydkh
Malware Config
Extracted
qakbot
404.14
BB05
1667208557
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 rundll32.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe 1232 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1308 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 2016 wrote to memory of 1308 2016 rundll32.exe 27 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28 PID 1308 wrote to memory of 1232 1308 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\contaminative.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\contaminative.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
-