Analysis
-
max time kernel
599s -
max time network
595s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-11-2022 14:32
Static task
static1
Behavioral task
behavioral1
Sample
SK.js
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
SK.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
manacle/wined.dll
Resource
win7-20220812-en
General
-
Target
manacle/wined.dll
-
Size
372KB
-
MD5
c5e7003aa6028dd3efb815b237eb8c20
-
SHA1
4b55fe56e050613b110d5db2b8a8fe232a660dc7
-
SHA256
c1cc35bebc0eb78fcf54af484936adec1603fdce672c9ac919ef5e739f3a0fd8
-
SHA512
6e914412e6c4a7c70acea44a0a2e1798e20d8e1f66b5aaf3eeb74046c1cb0362e4985f641f5456b2a85755f58f1f660b21acad25b1de0c347cf9b49ffd787991
-
SSDEEP
6144:l1eKK1u77wiWjvM9gaYhWawPSxipTR9K1/XseDA+sqKD9oqHs9Dz/RJhKXuz:mKzMD2gaSWcxITi/XsZ+s7pohvRJhr
Malware Config
Extracted
qakbot
404.30
BB06
1668752705
98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
50.68.204.71:443
24.142.218.202:443
66.191.69.18:995
183.82.100.110:2222
24.49.232.96:443
70.115.104.126:995
176.151.15.101:443
93.156.103.241:443
86.217.250.15:2222
12.172.173.82:443
173.18.126.3:443
157.231.42.190:443
92.24.200.226:995
187.199.224.16:32103
213.91.235.146:443
188.4.142.139:995
199.83.165.233:443
63.248.148.87:443
58.162.223.233:443
102.159.188.241:443
12.172.173.82:50001
174.45.15.123:443
86.171.75.63:443
75.99.125.238:2222
75.158.15.211:443
79.37.204.67:443
27.110.134.202:995
12.172.173.82:993
58.247.115.126:995
181.118.183.116:443
31.167.227.31:443
2.83.62.105:443
77.126.81.208:443
174.112.25.29:2222
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
213.191.164.70:443
130.43.107.232:995
12.172.173.82:995
71.46.234.170:443
109.11.175.42:2222
73.155.10.79:443
75.191.246.70:443
136.232.184.134:995
102.158.245.248:995
47.176.30.75:443
154.247.94.160:32103
103.141.50.117:995
69.119.123.159:2222
87.223.80.45:443
75.143.236.149:443
74.92.243.113:50000
74.33.84.227:443
86.225.214.138:2222
75.98.154.19:443
117.186.222.30:993
84.113.121.103:443
188.176.170.61:443
121.122.99.151:995
183.87.31.34:443
83.110.223.247:443
86.99.15.243:2222
78.69.251.252:2222
103.55.67.180:443
47.229.96.60:443
84.209.52.11:443
174.112.25.29:2078
84.35.26.14:995
99.253.115.160:443
68.47.128.161:443
87.65.160.87:995
172.90.139.138:2222
86.175.128.143:443
12.172.173.82:465
71.247.10.63:2083
47.41.154.250:443
71.31.101.183:443
81.229.117.95:2222
41.35.196.18:995
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
170.253.25.35:443
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
23.240.47.58:995
94.70.37.145:2222
72.200.109.104:443
99.229.146.120:443
158.62.157.184:443
184.155.91.69:443
80.0.74.165:443
24.4.239.157:443
76.80.180.154:995
176.142.207.63:443
69.133.162.35:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 1724 ipconfig.exe 1404 netstat.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 912 regsvr32.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe 1340 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 912 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
netstat.exewhoami.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1404 netstat.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeDebugPrivilege 1828 whoami.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeSecurityPrivilege 436 msiexec.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
regsvr32.exeregsvr32.exewermgr.exenet.exenet.exedescription pid process target process PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 1812 wrote to memory of 912 1812 regsvr32.exe regsvr32.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 912 wrote to memory of 1340 912 regsvr32.exe wermgr.exe PID 1340 wrote to memory of 856 1340 wermgr.exe net.exe PID 1340 wrote to memory of 856 1340 wermgr.exe net.exe PID 1340 wrote to memory of 856 1340 wermgr.exe net.exe PID 1340 wrote to memory of 856 1340 wermgr.exe net.exe PID 1340 wrote to memory of 388 1340 wermgr.exe cmd.exe PID 1340 wrote to memory of 388 1340 wermgr.exe cmd.exe PID 1340 wrote to memory of 388 1340 wermgr.exe cmd.exe PID 1340 wrote to memory of 388 1340 wermgr.exe cmd.exe PID 1340 wrote to memory of 1172 1340 wermgr.exe arp.exe PID 1340 wrote to memory of 1172 1340 wermgr.exe arp.exe PID 1340 wrote to memory of 1172 1340 wermgr.exe arp.exe PID 1340 wrote to memory of 1172 1340 wermgr.exe arp.exe PID 1340 wrote to memory of 1724 1340 wermgr.exe ipconfig.exe PID 1340 wrote to memory of 1724 1340 wermgr.exe ipconfig.exe PID 1340 wrote to memory of 1724 1340 wermgr.exe ipconfig.exe PID 1340 wrote to memory of 1724 1340 wermgr.exe ipconfig.exe PID 1340 wrote to memory of 1976 1340 wermgr.exe nslookup.exe PID 1340 wrote to memory of 1976 1340 wermgr.exe nslookup.exe PID 1340 wrote to memory of 1976 1340 wermgr.exe nslookup.exe PID 1340 wrote to memory of 1976 1340 wermgr.exe nslookup.exe PID 1340 wrote to memory of 1368 1340 wermgr.exe net.exe PID 1340 wrote to memory of 1368 1340 wermgr.exe net.exe PID 1340 wrote to memory of 1368 1340 wermgr.exe net.exe PID 1340 wrote to memory of 1368 1340 wermgr.exe net.exe PID 1368 wrote to memory of 2016 1368 net.exe net1.exe PID 1368 wrote to memory of 2016 1368 net.exe net1.exe PID 1368 wrote to memory of 2016 1368 net.exe net1.exe PID 1368 wrote to memory of 2016 1368 net.exe net1.exe PID 1340 wrote to memory of 1932 1340 wermgr.exe route.exe PID 1340 wrote to memory of 1932 1340 wermgr.exe route.exe PID 1340 wrote to memory of 1932 1340 wermgr.exe route.exe PID 1340 wrote to memory of 1932 1340 wermgr.exe route.exe PID 1340 wrote to memory of 1404 1340 wermgr.exe netstat.exe PID 1340 wrote to memory of 1404 1340 wermgr.exe netstat.exe PID 1340 wrote to memory of 1404 1340 wermgr.exe netstat.exe PID 1340 wrote to memory of 1404 1340 wermgr.exe netstat.exe PID 1340 wrote to memory of 552 1340 wermgr.exe net.exe PID 1340 wrote to memory of 552 1340 wermgr.exe net.exe PID 1340 wrote to memory of 552 1340 wermgr.exe net.exe PID 1340 wrote to memory of 552 1340 wermgr.exe net.exe PID 552 wrote to memory of 1680 552 net.exe net1.exe PID 552 wrote to memory of 1680 552 net.exe net1.exe PID 552 wrote to memory of 1680 552 net.exe net1.exe PID 552 wrote to memory of 1680 552 net.exe net1.exe PID 1340 wrote to memory of 1828 1340 wermgr.exe whoami.exe PID 1340 wrote to memory of 1828 1340 wermgr.exe whoami.exe PID 1340 wrote to memory of 1828 1340 wermgr.exe whoami.exe PID 1340 wrote to memory of 1828 1340 wermgr.exe whoami.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\manacle\wined.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\manacle\wined.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\net.exenet view4⤵
- Discovers systems in the same network
PID:856 -
C:\Windows\SysWOW64\cmd.execmd /c set4⤵PID:388
-
C:\Windows\SysWOW64\arp.exearp -a4⤵PID:1172
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:1724 -
C:\Windows\SysWOW64\nslookup.exenslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP4⤵PID:1976
-
C:\Windows\SysWOW64\net.exenet share4⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share5⤵PID:2016
-
C:\Windows\SysWOW64\route.exeroute print4⤵PID:1932
-
C:\Windows\SysWOW64\netstat.exenetstat -nao4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\SysWOW64\net.exenet localgroup4⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup5⤵PID:1680
-
C:\Windows\SysWOW64\whoami.exewhoami /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/388-65-0x0000000000000000-mapping.dmp
-
memory/552-74-0x0000000000000000-mapping.dmp
-
memory/856-64-0x0000000000000000-mapping.dmp
-
memory/912-59-0x0000000000170000-0x00000000001F0000-memory.dmpFilesize
512KB
-
memory/912-58-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB
-
memory/912-57-0x00000000001B0000-0x00000000001DA000-memory.dmpFilesize
168KB
-
memory/912-55-0x0000000000000000-mapping.dmp
-
memory/912-56-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB
-
memory/1172-66-0x0000000000000000-mapping.dmp
-
memory/1340-60-0x0000000000000000-mapping.dmp
-
memory/1340-62-0x0000000000110000-0x000000000013A000-memory.dmpFilesize
168KB
-
memory/1340-63-0x0000000000110000-0x000000000013A000-memory.dmpFilesize
168KB
-
memory/1368-70-0x0000000000000000-mapping.dmp
-
memory/1404-73-0x0000000000000000-mapping.dmp
-
memory/1680-75-0x0000000000000000-mapping.dmp
-
memory/1724-67-0x0000000000000000-mapping.dmp
-
memory/1812-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmpFilesize
8KB
-
memory/1828-77-0x0000000000000000-mapping.dmp
-
memory/1932-72-0x0000000000000000-mapping.dmp
-
memory/1976-69-0x0000000000000000-mapping.dmp
-
memory/2016-71-0x0000000000000000-mapping.dmp