Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/10/2022, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
DV.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
DV.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
selectable/dissatisfying.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
selectable/dissatisfying.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
selectable/fijian.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
selectable/fijian.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
selectable/dissatisfying.dll
-
Size
421KB
-
MD5
f64eb422a75b24a5c17652170378be83
-
SHA1
c046c28bffd587f07791b9dbf9b44e94d09c3f1a
-
SHA256
d4d435b2af9729aa9ce933182024508b8d89be94e88a91734f8d8719bb660f9a
-
SHA512
ffab3655152b44af3e963249e23e0957c664d2f0acbe1e46daf2207cc52bf0b2ab983f4b50a4685373f1ee307f7de81c5876a1e09e95390ae432b8de59a684d3
-
SSDEEP
6144:MkbHJhzU/Gr+acU2gqnEIzGOEBPepzn6WX1LB5QpK1K0we5itwWUTIAO7V:dheLacnx5dFBOpawe5iFP1V
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1116 regsvr32.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe 1396 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1116 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1476 wrote to memory of 1116 1476 regsvr32.exe 27 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28 PID 1116 wrote to memory of 1396 1116 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\selectable\dissatisfying.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\selectable\dissatisfying.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
-