Analysis
-
max time kernel
159s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
KL.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
KL.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
gatekeepers/accords.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
gatekeepers/accords.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
gatekeepers/offensively.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
gatekeepers/offensively.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
gatekeepers/wintered.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
gatekeepers/wintered.dll
-
Size
471KB
-
MD5
f2820153a9d1408f462e66409be99590
-
SHA1
8342712cbe3c55c5a4890ea72c2b0521894125e1
-
SHA256
a7a1d2368811451f8d266d79a2726d3984b40b5dd753012de3098454e4b3f25c
-
SHA512
8751d83517af32fb2f042ae1462b59965d95d9bf597ad3f4eda264f2995124a18841773175d60eb0174bd6798a9a300fe5a66a9ce4ce9e77c3147e407298c784
-
SSDEEP
6144:rFdsFJ6i5gi6QFklGtnWf+ajAjM1ShS5p+ppsJv3DTIjF0HHGh/O98CbS3Om5djF:3KZklGtnyfgHCvQFyHM3Om51EtJkiI
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1144 regsvr32.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe 1556 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1144 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1012 wrote to memory of 1144 1012 regsvr32.exe 28 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29 PID 1144 wrote to memory of 1556 1144 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\gatekeepers\wintered.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\gatekeepers\wintered.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-