Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-11-2022 05:43
Static task
static1
Behavioral task
behavioral1
Sample
SS.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
SS.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
pressurization/interceptor.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
pressurization/interceptor.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
pressurization/roughness.bat
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
pressurization/roughness.bat
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
pressurization/tricky.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
pressurization/tricky.dll
-
Size
755KB
-
MD5
243c552f305d208b8f5f231e7f3a7f83
-
SHA1
6b9778430ef2563ddb9198ec2b38822aec518f77
-
SHA256
3905804a6dba4a25bcc469bbd18dee15e6731cbf47c233997b1829f8dac36276
-
SHA512
b4edac5aaa0c4a15acc1c091eedcac595d93b68cd6a98e03aad00ee36b0ac10eecb6fe7a9ad626ae7363446629053a76a160ff7cade11c695174dd085da7663d
-
SSDEEP
12288:FN53TigGAAaYOjrtguXsmPKtbKgvAAfRcJtjm/1kfYuqd7pJeG5mCuq6vU6Pm:FHDiTF6jT5GKg3J8MwYum7p8NCuPvU6e
Malware Config
Extracted
qakbot
404.20
BB05
1667470599
181.118.183.103:443
92.239.81.124:443
174.58.146.57:443
73.223.248.31:443
86.129.13.178:2222
47.34.30.133:443
89.216.114.179:443
41.44.11.227:995
66.180.227.170:2222
46.229.194.17:443
190.74.248.136:443
88.122.208.197:32100
78.161.38.242:443
89.115.196.99:443
174.0.224.214:443
175.205.2.54:443
136.232.184.134:995
213.194.234.75:995
105.154.112.77:443
174.104.184.149:443
94.60.141.48:995
109.159.119.162:2222
85.241.180.94:443
197.1.252.96:995
64.207.237.118:443
144.202.15.58:443
74.33.84.227:443
86.225.214.138:2222
45.49.137.80:443
92.24.200.226:995
74.92.243.113:995
76.68.34.167:2222
27.33.237.105:443
201.192.179.221:443
154.247.15.173:990
149.126.159.224:443
91.68.227.219:443
109.151.171.116:2222
50.68.204.71:443
83.11.89.137:2222
190.18.236.175:443
91.138.17.202:443
82.141.152.214:443
154.247.15.173:995
154.247.15.173:32103
62.31.130.138:465
154.247.15.173:993
193.3.19.137:443
190.199.109.80:2222
212.251.122.147:995
73.36.196.11:443
75.156.125.215:995
58.247.115.126:995
50.68.204.71:993
157.231.42.190:443
92.185.204.18:2078
172.249.99.143:2087
73.165.119.20:443
190.24.45.24:995
187.199.171.252:32103
50.68.204.71:995
58.162.223.233:443
80.0.74.165:443
62.36.24.8:2222
154.247.15.173:465
81.159.35.141:2222
87.223.89.23:443
75.99.125.238:2222
58.186.75.42:443
197.204.182.47:443
75.98.154.19:443
36.152.128.2:2222
84.35.26.14:995
65.20.175.208:443
178.192.56.13:2222
154.247.15.173:2078
92.90.101.167:443
157.231.42.190:995
216.82.134.218:443
91.169.12.198:32100
110.23.76.9:2222
50.37.149.215:443
74.92.243.113:50000
200.233.108.153:995
91.165.188.74:50000
86.185.119.90:443
182.66.197.35:443
61.69.138.109:443
216.151.191.218:443
94.49.5.116:443
49.175.72.56:443
27.110.134.202:995
172.219.147.156:3389
70.181.149.227:443
84.113.121.103:443
92.239.222.177:443
87.99.116.47:443
24.4.239.157:443
66.168.180.66:443
84.209.52.11:443
68.146.18.15:443
173.32.181.236:443
142.115.159.36:2222
201.245.250.192:995
181.56.171.3:995
71.199.168.185:443
186.18.210.16:443
151.30.53.233:443
50.86.217.209:443
75.141.227.169:443
64.123.103.123:443
190.207.121.156:2222
186.73.140.43:443
87.220.68.51:2222
187.143.114.3:2222
217.39.57.121:443
172.117.139.142:995
87.218.114.203:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 rundll32.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe 108 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1176 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1336 wrote to memory of 1176 1336 rundll32.exe 27 PID 1176 wrote to memory of 108 1176 rundll32.exe 28 PID 1176 wrote to memory of 108 1176 rundll32.exe 28 PID 1176 wrote to memory of 108 1176 rundll32.exe 28 PID 1176 wrote to memory of 108 1176 rundll32.exe 28 PID 1176 wrote to memory of 108 1176 rundll32.exe 28 PID 1176 wrote to memory of 108 1176 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pressurization\tricky.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pressurization\tricky.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:108
-
-