Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/12/2022, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
sidetracking.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
sidetracking.dll
-
Size
695KB
-
MD5
ef0b0131dd0bc88c113b17f9049e8fb3
-
SHA1
8269f5fafb9d88d15a821d9311c8659148f854f7
-
SHA256
ccc80c73061729902431bf2fb0238df8f2a2da34b1d1bb7497e27c089c215272
-
SHA512
a06e89f706f7c0712146102424d94fa254282b8b49563f896d55dfa324610e5492bb6ba061e774ccb7983d269e315ee52e8c2344a5ff0fb0cfe4094ebfe524fd
-
SSDEEP
12288:nieL1vc1PdFjpmw5qS6xnGWnE/N285UT+QD1lNMA:i81IFnqnnEl5w9M
Malware Config
Extracted
qakbot
403.895
obama207
1664363417
217.165.146.158:993
41.97.179.58:443
86.132.13.49:2078
197.203.50.195:443
85.245.143.94:443
86.196.181.62:2222
102.190.190.242:995
105.184.133.198:995
179.111.23.186:32101
179.251.119.206:995
84.3.85.30:443
39.44.5.104:995
197.41.235.69:995
193.3.19.137:443
186.81.122.168:443
103.173.121.17:443
41.104.80.233:443
102.189.184.12:995
156.199.90.139:443
14.168.180.223:443
41.140.98.37:995
156.205.3.210:993
139.228.33.176:2222
134.35.12.0:443
49.205.197.13:443
131.100.40.13:995
73.252.27.208:995
82.217.55.20:443
176.177.136.35:443
180.232.159.9:443
41.68.209.102:995
186.90.144.235:2222
191.92.125.254:443
41.96.204.133:443
58.186.75.42:443
85.86.242.245:443
187.193.143.111:443
200.175.173.80:443
197.49.68.15:995
186.50.139.45:995
41.68.155.190:443
186.72.236.88:995
187.150.143.159:443
105.69.189.28:995
160.177.207.113:8443
41.102.97.28:443
193.254.32.156:443
88.168.84.62:443
156.218.169.48:995
41.105.159.42:443
186.53.115.151:995
186.48.206.63:995
151.231.60.200:2083
196.217.32.15:443
102.157.212.143:443
189.189.89.32:443
181.177.156.209:443
85.94.178.73:995
201.209.4.2:443
41.69.236.243:995
74.133.189.36:443
149.126.159.254:443
41.104.132.166:443
188.157.6.170:443
197.160.22.10:443
187.189.68.8:443
109.128.221.164:995
92.98.73.123:443
154.237.235.43:995
212.102.56.47:443
110.238.39.214:443
185.233.79.238:995
154.237.60.254:995
181.206.46.7:443
186.16.163.94:443
75.71.96.226:995
181.105.32.5:443
41.227.228.31:443
197.203.142.42:443
118.174.89.216:443
41.107.112.236:995
105.96.207.25:443
111.125.157.230:443
68.224.229.42:443
190.44.40.48:995
88.232.207.24:443
72.88.245.71:443
119.82.111.158:443
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
197.94.84.128:443
41.96.130.46:80
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
76.169.76.44:2222
68.53.110.74:995
41.69.103.179:995
194.166.205.204:995
89.211.223.138:2222
85.98.206.165:995
177.103.94.155:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
91.116.160.252:443
151.234.63.48:990
99.253.251.74:443
41.40.146.5:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 rundll32.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe 980 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 856 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 1196 wrote to memory of 856 1196 rundll32.exe 27 PID 856 wrote to memory of 980 856 rundll32.exe 28 PID 856 wrote to memory of 980 856 rundll32.exe 28 PID 856 wrote to memory of 980 856 rundll32.exe 28 PID 856 wrote to memory of 980 856 rundll32.exe 28 PID 856 wrote to memory of 980 856 rundll32.exe 28 PID 856 wrote to memory of 980 856 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sidetracking.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sidetracking.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:980
-
-