Overview
overview
10Static
static
KL.lnk
windows7-x64
10KL.lnk
windows10-2004-x64
10recoloring...me.dll
windows7-x64
10recoloring...me.dll
windows10-2004-x64
10recoloring/purrs.cmd
windows7-x64
1recoloring/purrs.cmd
windows10-2004-x64
1recoloring...ed.cmd
windows7-x64
1recoloring...ed.cmd
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/11/2022, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
KL.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
KL.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
recoloring/dolesome.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
recoloring/dolesome.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
recoloring/purrs.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
recoloring/purrs.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
recoloring/undeterred.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
recoloring/undeterred.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
recoloring/dolesome.dll
-
Size
483KB
-
MD5
aa613d31dc7d0fb141d17b0c8ffd38b3
-
SHA1
1d1bd4cc6ba9082a00b30a9ed3e010aa2d0d6c0d
-
SHA256
de39a0517470d1958cb53fa62bf239be2d9125f35282ad625d3a6865ba13d831
-
SHA512
ef2f97448f56ba913b78516f96bdef6b0c56876ba4bfbc1822963c26a4dc2fd84c970ecafd932f52397c0dfd8f95fb5411674eb66bc073c29edddf97f43f62c6
-
SSDEEP
12288:mIQG2dEYsv2gJEXE1DMv9/rsGPDp7Odk4:9s0pMVtPD1Q
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 876 regsvr32.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe 552 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 876 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 536 wrote to memory of 876 536 regsvr32.exe 28 PID 876 wrote to memory of 552 876 regsvr32.exe 29 PID 876 wrote to memory of 552 876 regsvr32.exe 29 PID 876 wrote to memory of 552 876 regsvr32.exe 29 PID 876 wrote to memory of 552 876 regsvr32.exe 29 PID 876 wrote to memory of 552 876 regsvr32.exe 29 PID 876 wrote to memory of 552 876 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\recoloring\dolesome.dll1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\recoloring\dolesome.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:552
-
-