Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
CO.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
CO.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
judicature/hypothalamic.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
judicature/hypothalamic.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
judicature/mucked.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
judicature/mucked.dll
-
Size
1.6MB
-
MD5
b9aed833999244d4861a6cc232de3fe5
-
SHA1
bb88cf8ac22a5feb01fb3f1d448c3dbf9b09b611
-
SHA256
63959c0cd8d14b1e6b589378d25fd9ed285cd108487ff645ea0b62eae7c14899
-
SHA512
de8e5a10e04e9555be8cace59e42f1a09ea3d9cb8e259794e09861d605d9050b01552823e256eb5be8b602495ed689817757b8c6e8ae41aeb00596ab62bb66c8
-
SSDEEP
24576:hdOBKJGDcYOGm+FpvC04Rl3ZC499TlgxE29S3G8Ok8YdSkQh:hs9dm+n60YZCZY3tR8Ydkh
Malware Config
Extracted
qakbot
404.14
BB05
1667208557
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2012 rundll32.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe 948 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2012 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 1800 wrote to memory of 2012 1800 rundll32.exe 28 PID 2012 wrote to memory of 948 2012 rundll32.exe 29 PID 2012 wrote to memory of 948 2012 rundll32.exe 29 PID 2012 wrote to memory of 948 2012 rundll32.exe 29 PID 2012 wrote to memory of 948 2012 rundll32.exe 29 PID 2012 wrote to memory of 948 2012 rundll32.exe 29 PID 2012 wrote to memory of 948 2012 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\mucked.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\mucked.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-