Analysis
- max time kernel
150s - max time network
52s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
21/11/2022, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
JG.js
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
JG.js
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
almond/lemur.dll
Resource
win7-20220901-en
windows7-x64
General
- Target almond/lemur.dll
- Size 490KB
- Sample221121-pv75daeb7s
- SHA256 3c0c4314624497645c426ed6e9fbfd37042f7aceb51e60a894135ea4a42851c0
- MD5 a736ea84089591e4b6ed3b4051f393d0
- SHA1 3147e258e01223ce2bff0e0346e9d90ca53859d1
- SHA512 7b61d9001060c2889b76f4852c1ee1facd47b06b84fa8f7a47e3fb0a403e0e7567a09c2062ac44ba94fee6c6d5606517011a0b9a557bebcfc9ab959329ca3509
- SSDEEP 6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TICMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTUiwz4agFwid7e
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.30
-
BB07
-
1669024152
-
69.119.123.159:2222
-
197.148.17.17:2078
-
174.104.184.149:443
-
12.172.173.82:995
-
91.68.227.219:443
-
85.241.180.94:443
-
83.7.53.150:443
-
213.22.188.57:2222
-
71.46.234.170:443
-
190.75.150.58:2222
-
86.98.15.100:995
-
89.115.196.99:443
-
83.31.254.67:2222
-
46.162.109.183:443
-
2.84.98.228:2222
-
78.69.251.252:2222
-
12.172.173.82:465
-
75.143.236.149:443
-
47.229.96.60:443
-
80.121.8.212:995
-
74.92.243.113:50000
-
86.225.214.138:2222
-
183.82.100.110:2222
-
86.175.128.143:443
-
105.103.41.128:990
-
121.122.99.151:995
-
82.121.237.106:2222
-
83.248.199.56:443
-
81.156.198.115:2222
-
24.228.132.224:2222
-
87.243.146.59:443
-
174.112.25.29:2078
-
84.35.26.14:995
-
174.45.15.123:443
-
83.110.90.214:995
-
87.65.160.87:995
-
172.90.139.138:2222
-
71.247.10.63:2083
-
47.41.154.250:443
-
80.103.77.44:2222
-
92.11.189.236:2222
-
81.229.117.95:2222
-
91.169.12.198:32100
-
62.31.130.138:465
-
188.92.64.68:443
-
58.186.75.42:443
-
85.59.61.52:2222
-
94.63.65.146:443
-
80.13.179.151:2222
-
24.206.27.39:443
-
170.253.25.35:443
-
157.231.42.190:995
-
184.153.132.82:443
-
174.101.111.4:443
-
23.240.47.58:995
-
217.128.91.196:2222
-
62.35.67.88:443
-
184.155.91.69:443
-
86.176.144.202:2222
-
86.213.224.109:2222
-
90.104.22.28:2222
-
76.80.180.154:995
-
174.77.209.5:443
-
184.176.154.83:995
-
58.247.115.126:995
-
69.133.162.35:443
-
71.183.236.133:443
-
102.47.130.52:995
-
103.141.50.117:995
-
116.75.63.124:443
-
70.66.199.12:443
-
92.185.204.18:2078
-
130.43.107.232:995
-
92.24.200.226:995
-
81.111.108.123:443
-
98.145.23.67:443
-
197.0.235.159:443
-
92.137.74.174:2222
-
92.207.132.174:2222
-
12.172.173.82:50001
-
76.127.192.23:443
-
12.172.173.82:21
-
176.142.207.63:443
-
83.110.223.247:443
-
71.247.10.63:50003
-
108.6.249.139:443
-
24.69.87.61:443
-
90.89.95.158:2222
-
89.129.109.27:2222
-
91.254.215.167:443
-
71.247.10.63:995
-
47.34.30.133:443
-
86.130.9.140:2222
-
70.64.77.115:443
-
87.223.80.45:443
-
180.151.104.143:443
-
109.57.68.154:443
-
103.55.67.180:443
-
75.99.125.238:2222
-
50.68.204.71:995
-
73.36.196.11:443
-
105.184.161.242:443
-
187.199.224.16:32103
-
105.103.41.128:32103
-
75.156.125.215:995
-
170.249.59.153:443
-
2.91.187.6:995
-
87.202.101.164:50000
-
105.103.41.128:465
-
74.66.134.24:443
-
172.117.139.142:995
-
87.1.202.122:443
-
105.103.41.128:2078
-
12.172.173.82:990
-
86.171.75.63:443
-
12.172.173.82:2087
-
105.103.41.128:22
-
24.142.218.202:443
-
66.191.69.18:995
-
45.248.169.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1288 regsvr32.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe 1336 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1288 regsvr32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1300 wrote to memory of 1288 1300 regsvr32.exe 27 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28 PID 1288 wrote to memory of 1336 1288 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\lemur.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\almond\lemur.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-