Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 12:27
Static task
static1
General
-
Target
d96f6623da707abcef8305634a7acfc1c2ca6004f988cdef41dfd52d24d1b373.dll
-
Size
420KB
-
MD5
b3b89c9431b875307bdb5cb2f24a93b8
-
SHA1
23f0b6874d656f09e60b81cbd438319fb736ab6b
-
SHA256
d96f6623da707abcef8305634a7acfc1c2ca6004f988cdef41dfd52d24d1b373
-
SHA512
364e6bd8fdaa5c6e95dc685ed8493fc01f31aea2b3998a75daab0da3b5532704864b878117d74e5bb6e35bf071714d997d011524eb5cd8557d34cb1239a5dfea
-
SSDEEP
6144:5MVSKlGqB/JXPX+c4BLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcUkq/GNU1E1T5Hb1
Malware Config
Extracted
qakbot
403.1051
obama217
1666765529
197.204.53.242:443
105.106.60.149:443
102.159.110.79:995
64.207.237.118:443
156.216.134.70:995
180.151.116.67:443
190.199.97.108:993
206.1.203.0:443
186.188.96.197:443
206.1.128.203:443
201.249.100.208:995
190.75.151.66:2222
198.2.51.242:993
90.165.109.4:2222
71.199.168.185:443
181.56.171.3:995
43.241.159.148:443
41.103.1.16:443
24.207.97.117:443
105.157.86.118:443
201.223.169.238:32100
47.14.229.4:443
70.60.142.214:2222
41.47.249.185:443
142.181.183.42:2222
41.62.165.152:443
41.97.205.96:443
41.97.14.60:443
151.213.183.141:995
75.84.234.68:443
186.18.210.16:443
41.96.204.196:443
64.123.103.123:443
186.48.174.77:995
152.170.17.136:443
160.176.151.70:995
78.179.135.247:443
191.33.187.192:2222
41.140.63.187:443
98.207.190.55:443
196.65.217.253:995
78.50.124.220:443
91.171.72.214:32100
186.154.189.162:995
101.109.44.197:995
97.92.4.205:8443
41.36.159.36:993
70.115.104.126:443
181.44.34.172:443
88.240.75.201:443
113.162.196.232:443
156.197.230.148:995
24.130.228.100:443
41.109.228.108:995
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
190.203.51.133:2222
96.46.230.10:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.108.133.151:443
41.104.155.245:443
65.140.11.170:443
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
41.101.193.38:443
105.155.151.29:995
196.207.146.151:443
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
186.18.77.99:443
41.107.78.169:443
149.126.159.224:443
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.199.156:2087
102.156.162.83:443
220.134.54.185:2222
88.132.109.147:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.142.102:443
190.203.106.109:2222
200.155.61.245:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5100 regsvr32.exe 5100 regsvr32.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe 2252 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5100 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5100 4820 regsvr32.exe 81 PID 4820 wrote to memory of 5100 4820 regsvr32.exe 81 PID 4820 wrote to memory of 5100 4820 regsvr32.exe 81 PID 5100 wrote to memory of 2252 5100 regsvr32.exe 82 PID 5100 wrote to memory of 2252 5100 regsvr32.exe 82 PID 5100 wrote to memory of 2252 5100 regsvr32.exe 82 PID 5100 wrote to memory of 2252 5100 regsvr32.exe 82 PID 5100 wrote to memory of 2252 5100 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d96f6623da707abcef8305634a7acfc1c2ca6004f988cdef41dfd52d24d1b373.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d96f6623da707abcef8305634a7acfc1c2ca6004f988cdef41dfd52d24d1b373.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252
-
-