Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-11-2022 07:35
Static task
static1
Behavioral task
behavioral1
Sample
07efdd0de11d53ecc09daf92e3f2cdb53abd05d57510d2f605ad777e4427e90b.dll
Resource
win7-20220812-en
General
-
Target
07efdd0de11d53ecc09daf92e3f2cdb53abd05d57510d2f605ad777e4427e90b.dll
-
Size
354KB
-
MD5
c4d74593ce8a2013cc189721c14b4a2e
-
SHA1
e096a6e1f12940357cfbe9751e571f125bacb1e7
-
SHA256
07efdd0de11d53ecc09daf92e3f2cdb53abd05d57510d2f605ad777e4427e90b
-
SHA512
45d39162948f6da56090d88431818904c6ee36b79a053e0fddf8d63887887c30eb3b298e3948e09bdd5b63096f2f195a592eadf1f02e1eb17cf0492ee68c21c1
-
SSDEEP
6144:INsacLpop/C9lIbtBMHkqmO+pefWRAw6hjSy/AACs98K/f+ZuDXKK8bTcTCaUza2:ss/tMrbQHt+ps1w6RcA3/2oXmbTdaUm2
Malware Config
Extracted
qakbot
404.14
obama220
1667373670
174.0.224.214:443
1.70.60.142:54792
74.33.84.227:443
1.175.205.2:13825
187.1.1.45:12681
190.24.45.24:995
1.50.68.204:18177
193.3.19.137:443
1.41.44.11:58115
73.165.119.20:443
58.247.115.126:995
1.84.35.26:3587
216.82.134.218:443
1.181.164.194:58369
187.1.1.74:23795
71.199.168.185:443
1.94.49.5:29697
187.0.1.108:11471
186.73.140.43:443
1.97.119.214:59649
187.1.1.50:22233
201.245.250.192:995
187.0.1.62:9060
24.69.87.61:443
187.0.1.78:42386
174.4.112.228:443
187.0.1.74:15150
109.154.46.73:443
187.0.1.78:41254
90.165.109.4:2222
156.220.4.75:993
187.0.1.41:25573
178.197.228.37:2222
187.0.1.51:56298
138.207.238.47:443
23.233.254.195:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1932 regsvr32.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe 480 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1932 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1764 wrote to memory of 1932 1764 regsvr32.exe 28 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29 PID 1932 wrote to memory of 480 1932 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\07efdd0de11d53ecc09daf92e3f2cdb53abd05d57510d2f605ad777e4427e90b.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\07efdd0de11d53ecc09daf92e3f2cdb53abd05d57510d2f605ad777e4427e90b.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:480
-
-