Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/10/2022, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
DV_9431.iso
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
DV_9431.iso
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
DV.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
DV.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
selectable/franchised.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
selectable/franchised.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
selectable/manometric.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
selectable/manometric.dll
-
Size
421KB
-
MD5
3d24e176ba2c968580092a4b98ff1145
-
SHA1
5d6f63fbeae9ab2c625abfd34a01b15f882b8337
-
SHA256
52e8a4d2509de652a27737602f2ba0775b2bc78ded2ee179caad136c38e27b23
-
SHA512
dc33c64ceacf87d71acd4c43f067adc2f8db147832da0c35d3d74d545011a7662b5698e4f27b11703d827b366ecb945095252344b9732126912fb22016e0c494
-
SSDEEP
6144:MkbHJhzU/Gr+acU2gqnEIzGOEBPepzn6WX1LB5QpK1K0we5itwWUT2AO7V:dheLacnx5dFBOpawe5iFF1V
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 regsvr32.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe 2036 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1640 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1692 wrote to memory of 1640 1692 regsvr32.exe 28 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29 PID 1640 wrote to memory of 2036 1640 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\selectable\manometric.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\selectable\manometric.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-