Overview
overview
10Static
static
KL.lnk
windows7-x64
10KL.lnk
windows10-2004-x64
10tights/gua...ng.cmd
windows7-x64
1tights/gua...ng.cmd
windows10-2004-x64
1tights/mandible.dll
windows7-x64
10tights/mandible.dll
windows10-2004-x64
10tights/surgeries.cmd
windows7-x64
1tights/surgeries.cmd
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2022 14:34
Static task
static1
Behavioral task
behavioral1
Sample
KL.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
KL.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
tights/guaranteeing.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
tights/guaranteeing.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
tights/mandible.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
tights/mandible.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
tights/surgeries.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
tights/surgeries.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
tights/mandible.dll
-
Size
421KB
-
MD5
2720f95a07be909773be386c354f489f
-
SHA1
ee1336d4c58feda3922ab671180d327eb045df8b
-
SHA256
f27c6f661babb56dc6643c1cc2f947e8e138a0a578b90ebcc71ba2300f48f0f3
-
SHA512
d3a49bc6025aa598306ff020259cf2059ec327dc306f646d3f440be6c16abbc674b048224f5cc93435abd909446b954da5147263a81df02a10cfdec147404b9a
-
SSDEEP
12288:Pkpde329VEdv++607q6YP4uo7N9wIegv8JowUShUPw:Pudy29ChzEooQ0Uw
Malware Config
Extracted
qakbot
404.20
BB05
1667294768
136.232.184.134:995
1.65.20.175:53249
187.0.1.154:63263
50.68.204.71:995
74.92.243.113:50000
1.149.126.159:57345
187.0.1.182:17093
123.3.240.16:995
76.68.34.167:2222
172.219.147.156:3389
94.49.5.116:443
187.0.1.181:14507
206.1.223.234:2087
187.0.1.186:18828
131.23.1.187:1
23.233.254.195:443
76.125.91.160:443
187.0.1.90:42349
70.51.139.148:2222
187.0.1.76:47526
151.213.183.141:995
187.0.1.45:9057
152.170.17.136:443
92.185.204.18:2078
187.0.1.47:3813
105.103.103.142:443
66.37.239.222:2078
41.141.112.224:443
66.37.239.222:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 regsvr32.exe 1312 regsvr32.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe 3600 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1312 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1176 wrote to memory of 1312 1176 regsvr32.exe 80 PID 1176 wrote to memory of 1312 1176 regsvr32.exe 80 PID 1176 wrote to memory of 1312 1176 regsvr32.exe 80 PID 1312 wrote to memory of 3600 1312 regsvr32.exe 81 PID 1312 wrote to memory of 3600 1312 regsvr32.exe 81 PID 1312 wrote to memory of 3600 1312 regsvr32.exe 81 PID 1312 wrote to memory of 3600 1312 regsvr32.exe 81 PID 1312 wrote to memory of 3600 1312 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tights\mandible.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\tights\mandible.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-