Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
18-11-2022 14:26
Static task
static1
Behavioral task
behavioral1
Sample
SK.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SK.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
manacle/wined.dll
Resource
win7-20221111-en
General
-
Target
manacle/wined.dll
-
Size
372KB
-
MD5
c5e7003aa6028dd3efb815b237eb8c20
-
SHA1
4b55fe56e050613b110d5db2b8a8fe232a660dc7
-
SHA256
c1cc35bebc0eb78fcf54af484936adec1603fdce672c9ac919ef5e739f3a0fd8
-
SHA512
6e914412e6c4a7c70acea44a0a2e1798e20d8e1f66b5aaf3eeb74046c1cb0362e4985f641f5456b2a85755f58f1f660b21acad25b1de0c347cf9b49ffd787991
-
SSDEEP
6144:l1eKK1u77wiWjvM9gaYhWawPSxipTR9K1/XseDA+sqKD9oqHs9Dz/RJhKXuz:mKzMD2gaSWcxITi/XsZ+s7pohvRJhr
Malware Config
Extracted
qakbot
404.30
BB06
1668752705
98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
50.68.204.71:443
24.142.218.202:443
66.191.69.18:995
183.82.100.110:2222
24.49.232.96:443
70.115.104.126:995
176.151.15.101:443
93.156.103.241:443
86.217.250.15:2222
12.172.173.82:443
173.18.126.3:443
157.231.42.190:443
92.24.200.226:995
187.199.224.16:32103
213.91.235.146:443
188.4.142.139:995
199.83.165.233:443
63.248.148.87:443
58.162.223.233:443
102.159.188.241:443
12.172.173.82:50001
174.45.15.123:443
86.171.75.63:443
75.99.125.238:2222
75.158.15.211:443
79.37.204.67:443
27.110.134.202:995
12.172.173.82:993
58.247.115.126:995
181.118.183.116:443
31.167.227.31:443
2.83.62.105:443
77.126.81.208:443
174.112.25.29:2222
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
213.191.164.70:443
130.43.107.232:995
12.172.173.82:995
71.46.234.170:443
109.11.175.42:2222
73.155.10.79:443
75.191.246.70:443
136.232.184.134:995
102.158.245.248:995
47.176.30.75:443
154.247.94.160:32103
103.141.50.117:995
69.119.123.159:2222
87.223.80.45:443
75.143.236.149:443
74.92.243.113:50000
74.33.84.227:443
86.225.214.138:2222
75.98.154.19:443
117.186.222.30:993
84.113.121.103:443
188.176.170.61:443
121.122.99.151:995
183.87.31.34:443
83.110.223.247:443
86.99.15.243:2222
78.69.251.252:2222
103.55.67.180:443
47.229.96.60:443
84.209.52.11:443
174.112.25.29:2078
84.35.26.14:995
99.253.115.160:443
68.47.128.161:443
87.65.160.87:995
172.90.139.138:2222
86.175.128.143:443
12.172.173.82:465
71.247.10.63:2083
47.41.154.250:443
71.31.101.183:443
81.229.117.95:2222
41.35.196.18:995
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
23.240.47.58:995
94.70.37.145:2222
72.200.109.104:443
99.229.146.120:443
158.62.157.184:443
184.155.91.69:443
80.0.74.165:443
24.4.239.157:443
76.80.180.154:995
176.142.207.63:443
69.133.162.35:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 1124 regsvr32.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe 752 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1124 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 1124 1204 regsvr32.exe regsvr32.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe PID 1124 wrote to memory of 752 1124 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\manacle\wined.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\manacle\wined.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-