Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 03:22
Static task
static1
Behavioral task
behavioral1
Sample
unindented.dll
Resource
win7-20220901-en
General
-
Target
unindented.dll
-
Size
420KB
-
MD5
43724b02905c03b8e7078d4a4293816a
-
SHA1
0862ffbb70439e50766f4166e9c556cbca4d801b
-
SHA256
61a960bda55380f589189818462614592cd5d18d7d2eb5a21e57d1f489ce36fa
-
SHA512
11d5c61c6d88e8ed37707a03fd506ea75cc9948286bc9719850bb600a4b90c2e332ec02d3f711d8a165deeec9ce037b348468d71137755a2682ecd05d6d581eb
-
SSDEEP
6144:5MVSKlGqB/JXPX+c1BLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWc/kq/GNU1E1T5Hb1
Malware Config
Extracted
qakbot
403.1051
obama217
1666765529
197.204.53.242:443
105.106.60.149:443
102.159.110.79:995
64.207.237.118:443
156.216.134.70:995
180.151.116.67:443
190.199.97.108:993
206.1.203.0:443
186.188.96.197:443
206.1.128.203:443
201.249.100.208:995
190.75.151.66:2222
198.2.51.242:993
90.165.109.4:2222
71.199.168.185:443
181.56.171.3:995
43.241.159.148:443
41.103.1.16:443
24.207.97.117:443
105.157.86.118:443
201.223.169.238:32100
47.14.229.4:443
70.60.142.214:2222
41.47.249.185:443
142.181.183.42:2222
41.62.165.152:443
41.97.205.96:443
41.97.14.60:443
151.213.183.141:995
75.84.234.68:443
186.18.210.16:443
41.96.204.196:443
64.123.103.123:443
186.48.174.77:995
152.170.17.136:443
160.176.151.70:995
78.179.135.247:443
191.33.187.192:2222
41.140.63.187:443
98.207.190.55:443
196.65.217.253:995
78.50.124.220:443
91.171.72.214:32100
186.154.189.162:995
101.109.44.197:995
97.92.4.205:8443
41.36.159.36:993
70.115.104.126:443
181.44.34.172:443
88.240.75.201:443
113.162.196.232:443
156.197.230.148:995
24.130.228.100:443
41.109.228.108:995
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
190.203.51.133:2222
96.46.230.10:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.108.133.151:443
41.104.155.245:443
65.140.11.170:443
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
41.101.193.38:443
105.155.151.29:995
196.207.146.151:443
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
186.18.77.99:443
41.107.78.169:443
149.126.159.224:443
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.199.156:2087
102.156.162.83:443
220.134.54.185:2222
88.132.109.147:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.142.102:443
190.203.106.109:2222
200.155.61.245:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 1524 regsvr32.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe 1020 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1524 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1328 wrote to memory of 1524 1328 regsvr32.exe regsvr32.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe PID 1524 wrote to memory of 1020 1524 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\unindented.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\unindented.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-61-0x0000000000000000-mapping.dmp
-
memory/1020-63-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1020-64-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1328-54-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmpFilesize
8KB
-
memory/1524-55-0x0000000000000000-mapping.dmp
-
memory/1524-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1524-57-0x00000000001F0000-0x0000000000219000-memory.dmpFilesize
164KB
-
memory/1524-58-0x00000000001F0000-0x0000000000219000-memory.dmpFilesize
164KB
-
memory/1524-59-0x00000000001B0000-0x0000000000230000-memory.dmpFilesize
512KB
-
memory/1524-60-0x00000000001B0000-0x0000000000230000-memory.dmpFilesize
512KB