Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2022 18:48
Static task
static1
Behavioral task
behavioral1
Sample
0814681613393556154154ded4bec81fbc2fa05b895c949fe8a914288dc958ef.dll
Resource
win7-20220812-en
General
-
Target
0814681613393556154154ded4bec81fbc2fa05b895c949fe8a914288dc958ef.dll
-
Size
386KB
-
MD5
9e8b95a47595bdd269a946baf7ec7004
-
SHA1
aa485992b4d3e4fbff6332b89b8c8ee41e026c3e
-
SHA256
0814681613393556154154ded4bec81fbc2fa05b895c949fe8a914288dc958ef
-
SHA512
59c54113670e817a6ced3c6dc740db262b917f04a0402ae684a69cc5ca5e9f17c2abc5d6f5045faaffc96e6fa431e16656211acc42b5b48000717db5bb4a5d52
-
SSDEEP
6144:XtgTFlqteWTBa5WsoUReNsyLK9w8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN9dtniPHlQEFYM
Malware Config
Extracted
qakbot
403.914
obama210
1665041236
41.104.205.128:443
134.35.6.76:443
197.202.163.4:443
181.164.194.228:443
105.159.124.224:443
197.158.89.85:443
41.96.33.236:443
181.141.3.126:443
123.22.7.132:443
163.182.177.80:443
41.248.72.229:8443
41.100.62.129:443
68.83.169.91:443
190.29.228.61:443
160.176.249.11:995
41.107.54.99:443
94.52.127.44:443
105.69.155.85:995
45.227.251.167:2222
197.206.141.97:443
149.126.159.254:443
181.44.34.172:443
81.184.181.215:443
148.213.109.165:995
105.111.44.93:443
42.189.12.36:80
72.88.245.71:443
181.114.169.156:443
98.143.70.147:2222
197.94.70.41:443
197.11.134.255:443
197.204.247.7:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 4808 regsvr32.exe 4808 regsvr32.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe 4500 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4808 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1092 wrote to memory of 4808 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 4808 1092 regsvr32.exe regsvr32.exe PID 1092 wrote to memory of 4808 1092 regsvr32.exe regsvr32.exe PID 4808 wrote to memory of 4500 4808 regsvr32.exe wermgr.exe PID 4808 wrote to memory of 4500 4808 regsvr32.exe wermgr.exe PID 4808 wrote to memory of 4500 4808 regsvr32.exe wermgr.exe PID 4808 wrote to memory of 4500 4808 regsvr32.exe wermgr.exe PID 4808 wrote to memory of 4500 4808 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0814681613393556154154ded4bec81fbc2fa05b895c949fe8a914288dc958ef.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0814681613393556154154ded4bec81fbc2fa05b895c949fe8a914288dc958ef.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4500-134-0x0000000000000000-mapping.dmp
-
memory/4500-136-0x0000000000B70000-0x0000000000B92000-memory.dmpFilesize
136KB
-
memory/4500-137-0x0000000000B70000-0x0000000000B92000-memory.dmpFilesize
136KB
-
memory/4808-132-0x0000000000000000-mapping.dmp
-
memory/4808-133-0x0000000000CD0000-0x0000000000CF2000-memory.dmpFilesize
136KB
-
memory/4808-135-0x0000000000CD0000-0x0000000000CF2000-memory.dmpFilesize
136KB