Overview
overview
10Static
static
KL.lnk
windows7-x64
10KL.lnk
windows10-2004-x64
10tights/gua...ng.cmd
windows7-x64
1tights/gua...ng.cmd
windows10-2004-x64
1tights/mandible.dll
windows7-x64
10tights/mandible.dll
windows10-2004-x64
10tights/surgeries.cmd
windows7-x64
1tights/surgeries.cmd
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
KL.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
KL.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
tights/guaranteeing.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
tights/guaranteeing.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
tights/mandible.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
tights/mandible.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
tights/surgeries.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
tights/surgeries.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
tights/mandible.dll
-
Size
421KB
-
MD5
2720f95a07be909773be386c354f489f
-
SHA1
ee1336d4c58feda3922ab671180d327eb045df8b
-
SHA256
f27c6f661babb56dc6643c1cc2f947e8e138a0a578b90ebcc71ba2300f48f0f3
-
SHA512
d3a49bc6025aa598306ff020259cf2059ec327dc306f646d3f440be6c16abbc674b048224f5cc93435abd909446b954da5147263a81df02a10cfdec147404b9a
-
SSDEEP
12288:Pkpde329VEdv++607q6YP4uo7N9wIegv8JowUShUPw:Pudy29ChzEooQ0Uw
Malware Config
Extracted
qakbot
404.20
BB05
1667294768
136.232.184.134:995
1.65.20.175:53249
187.0.1.154:63263
50.68.204.71:995
74.92.243.113:50000
1.149.126.159:57345
187.0.1.182:17093
123.3.240.16:995
76.68.34.167:2222
172.219.147.156:3389
94.49.5.116:443
187.0.1.181:14507
206.1.223.234:2087
187.0.1.186:18828
131.23.1.187:1
23.233.254.195:443
76.125.91.160:443
187.0.1.90:42349
70.51.139.148:2222
187.0.1.76:47526
151.213.183.141:995
187.0.1.45:9057
152.170.17.136:443
92.185.204.18:2078
187.0.1.47:3813
105.103.103.142:443
66.37.239.222:2078
41.141.112.224:443
66.37.239.222:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1884 regsvr32.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe 1252 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1884 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 864 wrote to memory of 1884 864 regsvr32.exe 28 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29 PID 1884 wrote to memory of 1252 1884 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tights\mandible.dll1⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\tights\mandible.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-