Analysis
-
max time kernel
599s -
max time network
601s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
vindictive.dll
Resource
win7-20220812-en
General
-
Target
vindictive.dll
-
Size
728KB
-
MD5
498400b89b128894f12be5ae52c952a2
-
SHA1
c16b1a237a86b0131e92f297ef8a0348a1c315e9
-
SHA256
989b29f67457e554e50264708ba884f957b908c206014d91f74180ae1938f6f7
-
SHA512
dbf15315ea02db81dcba4e32412b52a0d9f0945254ab8a1ae071545ff5beda921f5a00780f75c790404b37488f17a78f4c2a84f589b8e801bcc2df4d311696c5
-
SSDEEP
12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIsM4WV6nwldJOCPrHuD5:9ta1DjZBBAgd1M4F6dMCjHu
Malware Config
Extracted
qakbot
403.1051
obama216
1666689942
24.116.45.121:443
24.206.27.39:443
71.199.168.185:443
70.115.104.126:443
190.24.45.24:995
24.9.220.167:443
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
197.202.196.43:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1988 rundll32.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe 1760 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1988 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1808 wrote to memory of 1988 1808 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe PID 1988 wrote to memory of 1760 1988 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vindictive.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vindictive.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-62-0x0000000000000000-mapping.dmp
-
memory/1760-65-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1760-66-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1988-54-0x0000000000000000-mapping.dmp
-
memory/1988-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1988-56-0x0000000000750000-0x000000000080A000-memory.dmpFilesize
744KB
-
memory/1988-57-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB
-
memory/1988-58-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB
-
memory/1988-59-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB
-
memory/1988-60-0x0000000000880000-0x00000000008A9000-memory.dmpFilesize
164KB
-
memory/1988-61-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB
-
memory/1988-64-0x00000000008E0000-0x0000000000909000-memory.dmpFilesize
164KB