Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2022, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
JG.js
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
JG.js
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
almond/lemur.dll
Resource
win7-20220901-en
windows7-x64
General
- Target almond/lemur.dll
- Size 490KB
- Sample221121-pv75daeb7s
- SHA256 3c0c4314624497645c426ed6e9fbfd37042f7aceb51e60a894135ea4a42851c0
- MD5 a736ea84089591e4b6ed3b4051f393d0
- SHA1 3147e258e01223ce2bff0e0346e9d90ca53859d1
- SHA512 7b61d9001060c2889b76f4852c1ee1facd47b06b84fa8f7a47e3fb0a403e0e7567a09c2062ac44ba94fee6c6d5606517011a0b9a557bebcfc9ab959329ca3509
- SSDEEP 6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TICMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTUiwz4agFwid7e
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.30
-
BB07
-
1669024152
-
69.119.123.159:2222
-
197.148.17.17:2078
-
174.104.184.149:443
-
12.172.173.82:995
-
91.68.227.219:443
-
85.241.180.94:443
-
83.7.53.150:443
-
213.22.188.57:2222
-
71.46.234.170:443
-
190.75.150.58:2222
-
86.98.15.100:995
-
89.115.196.99:443
-
83.31.254.67:2222
-
46.162.109.183:443
-
2.84.98.228:2222
-
78.69.251.252:2222
-
12.172.173.82:465
-
75.143.236.149:443
-
47.229.96.60:443
-
80.121.8.212:995
-
74.92.243.113:50000
-
86.225.214.138:2222
-
183.82.100.110:2222
-
86.175.128.143:443
-
105.103.41.128:990
-
121.122.99.151:995
-
82.121.237.106:2222
-
83.248.199.56:443
-
81.156.198.115:2222
-
24.228.132.224:2222
-
87.243.146.59:443
-
174.112.25.29:2078
-
84.35.26.14:995
-
174.45.15.123:443
-
83.110.90.214:995
-
87.65.160.87:995
-
172.90.139.138:2222
-
71.247.10.63:2083
-
47.41.154.250:443
-
80.103.77.44:2222
-
92.11.189.236:2222
-
81.229.117.95:2222
-
91.169.12.198:32100
-
62.31.130.138:465
-
188.92.64.68:443
-
58.186.75.42:443
-
85.59.61.52:2222
-
94.63.65.146:443
-
80.13.179.151:2222
-
24.206.27.39:443
-
170.253.25.35:443
-
157.231.42.190:995
-
184.153.132.82:443
-
174.101.111.4:443
-
23.240.47.58:995
-
217.128.91.196:2222
-
62.35.67.88:443
-
184.155.91.69:443
-
86.176.144.202:2222
-
86.213.224.109:2222
-
90.104.22.28:2222
-
76.80.180.154:995
-
174.77.209.5:443
-
184.176.154.83:995
-
58.247.115.126:995
-
69.133.162.35:443
-
71.183.236.133:443
-
102.47.130.52:995
-
103.141.50.117:995
-
116.75.63.124:443
-
70.66.199.12:443
-
92.185.204.18:2078
-
130.43.107.232:995
-
92.24.200.226:995
-
81.111.108.123:443
-
98.145.23.67:443
-
197.0.235.159:443
-
92.137.74.174:2222
-
92.207.132.174:2222
-
12.172.173.82:50001
-
76.127.192.23:443
-
12.172.173.82:21
-
176.142.207.63:443
-
83.110.223.247:443
-
71.247.10.63:50003
-
108.6.249.139:443
-
24.69.87.61:443
-
90.89.95.158:2222
-
89.129.109.27:2222
-
91.254.215.167:443
-
71.247.10.63:995
-
47.34.30.133:443
-
86.130.9.140:2222
-
70.64.77.115:443
-
87.223.80.45:443
-
180.151.104.143:443
-
109.57.68.154:443
-
103.55.67.180:443
-
75.99.125.238:2222
-
50.68.204.71:995
-
73.36.196.11:443
-
105.184.161.242:443
-
187.199.224.16:32103
-
105.103.41.128:32103
-
75.156.125.215:995
-
170.249.59.153:443
-
2.91.187.6:995
-
87.202.101.164:50000
-
105.103.41.128:465
-
74.66.134.24:443
-
172.117.139.142:995
-
87.1.202.122:443
-
105.103.41.128:2078
-
12.172.173.82:990
-
86.171.75.63:443
-
12.172.173.82:2087
-
105.103.41.128:22
-
24.142.218.202:443
-
66.191.69.18:995
-
45.248.169.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4424 regsvr32.exe 4424 regsvr32.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe 4880 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4424 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4424 2104 regsvr32.exe 83 PID 2104 wrote to memory of 4424 2104 regsvr32.exe 83 PID 2104 wrote to memory of 4424 2104 regsvr32.exe 83 PID 4424 wrote to memory of 4880 4424 regsvr32.exe 84 PID 4424 wrote to memory of 4880 4424 regsvr32.exe 84 PID 4424 wrote to memory of 4880 4424 regsvr32.exe 84 PID 4424 wrote to memory of 4880 4424 regsvr32.exe 84 PID 4424 wrote to memory of 4880 4424 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\lemur.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\almond\lemur.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880
-
-