Overview
overview
10Static
static
KL.lnk
windows7-x64
10KL.lnk
windows10-2004-x64
10recoloring...me.dll
windows7-x64
10recoloring...me.dll
windows10-2004-x64
10recoloring/purrs.cmd
windows7-x64
1recoloring/purrs.cmd
windows10-2004-x64
1recoloring...ed.cmd
windows7-x64
1recoloring...ed.cmd
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2022 08:47
Static task
static1
Behavioral task
behavioral1
Sample
KL.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
KL.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
recoloring/dolesome.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
recoloring/dolesome.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
recoloring/purrs.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
recoloring/purrs.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
recoloring/undeterred.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
recoloring/undeterred.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
recoloring/dolesome.dll
-
Size
483KB
-
MD5
aa613d31dc7d0fb141d17b0c8ffd38b3
-
SHA1
1d1bd4cc6ba9082a00b30a9ed3e010aa2d0d6c0d
-
SHA256
de39a0517470d1958cb53fa62bf239be2d9125f35282ad625d3a6865ba13d831
-
SHA512
ef2f97448f56ba913b78516f96bdef6b0c56876ba4bfbc1822963c26a4dc2fd84c970ecafd932f52397c0dfd8f95fb5411674eb66bc073c29edddf97f43f62c6
-
SSDEEP
12288:mIQG2dEYsv2gJEXE1DMv9/rsGPDp7Odk4:9s0pMVtPD1Q
Malware Config
Extracted
qakbot
404.14
BB05
1667208499
174.77.209.5:443
187.0.1.74:23795
24.206.27.39:443
1.156.220.169:30723
156.216.39.119:995
58.186.75.42:443
1.156.197.160:30467
187.1.1.190:4844
186.18.210.16:443
1.181.56.171:771
90.165.109.4:2222
187.0.1.186:39742
87.57.13.215:443
187.0.1.207:52344
227.26.3.227:1
98.207.190.55:443
187.0.1.197:7017
188.49.56.189:443
102.156.160.115:443
187.0.1.24:17751
70.51.139.148:2222
187.0.1.109:34115
14.164.18.210:443
187.0.1.97:30597
205.161.22.189:443
187.0.1.151:54711
196.217.63.248:443
187.0.1.160:45243
66.37.239.222:443
24.207.97.40:443
187.0.1.59:24056
68.62.199.70:443
45.230.169.132:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4724 regsvr32.exe 4724 regsvr32.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe 1240 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4724 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 848 wrote to memory of 4724 848 regsvr32.exe 82 PID 848 wrote to memory of 4724 848 regsvr32.exe 82 PID 848 wrote to memory of 4724 848 regsvr32.exe 82 PID 4724 wrote to memory of 1240 4724 regsvr32.exe 86 PID 4724 wrote to memory of 1240 4724 regsvr32.exe 86 PID 4724 wrote to memory of 1240 4724 regsvr32.exe 86 PID 4724 wrote to memory of 1240 4724 regsvr32.exe 86 PID 4724 wrote to memory of 1240 4724 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\recoloring\dolesome.dll1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\recoloring\dolesome.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240
-
-