Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 06:26
Static task
static1
Behavioral task
behavioral1
Sample
ContractCopy_YZ62.iso
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
ContractCopy_YZ62.iso
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ContractCopy.js
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral4
Sample
ContractCopy.js
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
addled/soloists.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
addled/soloists.dll
-
Size
781KB
-
MD5
b60b9fedc3fcf9011446349ab6430719
-
SHA1
e706be44c0bf3cf12ee1b357b0d037f172a5220a
-
SHA256
5f715c36aa0f2e60500bbc501eaacdb1e95ed38959f03a38e52009d3ec2a864f
-
SHA512
bd226954a1e8d72bafa2c5c6ac7e001b74284d1f09e785c8323bb96f4fa0b7694eb2d8105b4741438907b49c6b9e298d692652f95a31190abf7ce0a2c5fa5922
-
SSDEEP
12288:3+ed7zMD42lTz4kg3Wdf8+wawM375RGyin7ZlUP9XqcYX:Zd7QUoTzEWdfwTTn3M9XqdX
Malware Config
Extracted
qakbot
404.30
obama222
1668692319
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
188.54.79.88:995
87.220.205.14:2222
72.88.245.71:443
92.137.74.174:2222
91.68.227.219:443
184.153.132.82:443
74.66.134.24:443
47.16.73.77:2222
41.97.183.39:443
177.205.92.100:2222
24.64.114.59:3389
105.111.45.51:995
86.180.222.237:2222
76.184.95.190:993
142.119.40.220:2222
92.27.86.48:2222
180.156.240.239:995
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
64.121.161.102:443
50.90.249.161:443
70.115.104.126:995
99.238.106.45:443
72.140.137.221:443
174.77.209.5:443
174.104.184.149:443
2.84.98.228:2222
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
85.59.61.52:2222
85.139.176.42:2222
157.231.42.190:443
85.74.158.150:2222
12.172.173.82:2087
109.152.70.207:50000
12.172.173.82:22
50.68.204.71:995
45.248.169.101:443
76.20.42.45:443
2.8.39.175:2222
81.250.33.243:2222
213.91.235.146:443
136.35.241.159:443
82.121.73.56:2222
173.239.94.212:443
184.20.10.236:443
187.199.224.16:32103
183.82.100.110:2222
102.156.113.77:443
75.99.125.238:2222
82.121.237.106:2222
79.37.204.67:443
85.241.180.94:443
217.128.91.196:2222
12.172.173.82:443
91.180.68.95:2222
98.187.21.2:443
82.9.210.36:443
181.118.183.116:443
174.45.15.123:443
2.83.62.105:443
84.113.121.103:443
77.126.81.208:443
92.106.70.62:2222
12.172.173.82:993
212.251.122.147:995
102.157.69.217:995
69.119.123.159:2222
47.176.30.75:443
87.223.80.45:443
174.60.47.98:443
173.32.181.236:443
41.228.223.122:995
82.36.36.76:443
154.247.94.160:32103
12.172.173.82:50001
12.172.173.82:995
172.90.139.138:2222
86.175.128.143:443
75.143.236.149:443
75.98.154.19:443
81.156.198.115:2222
80.121.8.212:995
103.55.67.180:443
89.152.120.181:443
83.79.150.24:2222
74.92.243.113:50000
87.220.68.51:2222
69.133.162.35:443
80.103.77.44:2222
61.92.123.169:443
74.33.84.227:443
86.225.214.138:2222
80.189.213.49:2222
188.92.64.68:443
109.145.27.139:443
121.122.99.151:995
47.185.141.97:443
81.229.117.95:2222
84.35.26.14:995
68.47.128.161:443
71.31.101.183:443
75.191.246.70:443
41.35.196.18:995
87.65.160.87:995
88.126.94.4:50000
102.158.230.141:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1952 regsvr32.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe 1108 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1952 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1636 wrote to memory of 1952 1636 regsvr32.exe 28 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29 PID 1952 wrote to memory of 1108 1952 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\addled\soloists.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\addled\soloists.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-