Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/12/2022, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
nequ_020B0000.bin.dll
Resource
win7-20220812-en
General
-
Target
nequ_020B0000.bin.dll
-
Size
2.1MB
-
MD5
b12e01985b5daecc58d7cec5b37462ed
-
SHA1
a8654d9b674a330db1f0c8881d678687ab53a0b7
-
SHA256
012747575632a83c77d73b90450612446664d78c5a6a1af082c5da1485f6e9e1
-
SHA512
069685718c6ba4737fd9fb97dc1c36aad80fa75cab171ee88b1cddb145107798a21f53812d1c3483eb6548a1b1ad64bbda5cdc6f08ce1aa46540146379b055f3
-
SSDEEP
49152:SWZ5HwJW2sYVMxHqAHIferky/njn/r8CU36+eRNl:SWZ5HwJDdVCQerRjn/rZU3KR
Malware Config
Extracted
qakbot
404.62
BB11
1671561386
184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 1736 rundll32.exe 1736 rundll32.exe 1736 rundll32.exe 1736 rundll32.exe -
Runs ping.exe 1 TTPs 10 IoCs
pid Process 688 PING.EXE 316 PING.EXE 804 PING.EXE 1636 PING.EXE 744 PING.EXE 648 PING.EXE 784 PING.EXE 432 PING.EXE 1380 PING.EXE 1740 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 rundll32.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe 992 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1736 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1736 540 rundll32.exe 28 PID 540 wrote to memory of 1768 540 rundll32.exe 29 PID 540 wrote to memory of 1768 540 rundll32.exe 29 PID 540 wrote to memory of 1768 540 rundll32.exe 29 PID 540 wrote to memory of 1768 540 rundll32.exe 29 PID 1768 wrote to memory of 648 1768 cmd.exe 31 PID 1768 wrote to memory of 648 1768 cmd.exe 31 PID 1768 wrote to memory of 648 1768 cmd.exe 31 PID 1768 wrote to memory of 648 1768 cmd.exe 31 PID 1768 wrote to memory of 784 1768 cmd.exe 32 PID 1768 wrote to memory of 784 1768 cmd.exe 32 PID 1768 wrote to memory of 784 1768 cmd.exe 32 PID 1768 wrote to memory of 784 1768 cmd.exe 32 PID 1768 wrote to memory of 688 1768 cmd.exe 33 PID 1768 wrote to memory of 688 1768 cmd.exe 33 PID 1768 wrote to memory of 688 1768 cmd.exe 33 PID 1768 wrote to memory of 688 1768 cmd.exe 33 PID 1768 wrote to memory of 432 1768 cmd.exe 34 PID 1768 wrote to memory of 432 1768 cmd.exe 34 PID 1768 wrote to memory of 432 1768 cmd.exe 34 PID 1768 wrote to memory of 432 1768 cmd.exe 34 PID 1768 wrote to memory of 316 1768 cmd.exe 35 PID 1768 wrote to memory of 316 1768 cmd.exe 35 PID 1768 wrote to memory of 316 1768 cmd.exe 35 PID 1768 wrote to memory of 316 1768 cmd.exe 35 PID 1768 wrote to memory of 804 1768 cmd.exe 36 PID 1768 wrote to memory of 804 1768 cmd.exe 36 PID 1768 wrote to memory of 804 1768 cmd.exe 36 PID 1768 wrote to memory of 804 1768 cmd.exe 36 PID 1768 wrote to memory of 1380 1768 cmd.exe 37 PID 1768 wrote to memory of 1380 1768 cmd.exe 37 PID 1768 wrote to memory of 1380 1768 cmd.exe 37 PID 1768 wrote to memory of 1380 1768 cmd.exe 37 PID 1768 wrote to memory of 1740 1768 cmd.exe 38 PID 1768 wrote to memory of 1740 1768 cmd.exe 38 PID 1768 wrote to memory of 1740 1768 cmd.exe 38 PID 1768 wrote to memory of 1740 1768 cmd.exe 38 PID 1768 wrote to memory of 1636 1768 cmd.exe 39 PID 1768 wrote to memory of 1636 1768 cmd.exe 39 PID 1768 wrote to memory of 1636 1768 cmd.exe 39 PID 1768 wrote to memory of 1636 1768 cmd.exe 39 PID 1768 wrote to memory of 744 1768 cmd.exe 40 PID 1768 wrote to memory of 744 1768 cmd.exe 40 PID 1768 wrote to memory of 744 1768 cmd.exe 40 PID 1768 wrote to memory of 744 1768 cmd.exe 40 PID 1736 wrote to memory of 992 1736 rundll32.exe 41 PID 1736 wrote to memory of 992 1736 rundll32.exe 41 PID 1736 wrote to memory of 992 1736 rundll32.exe 41 PID 1736 wrote to memory of 992 1736 rundll32.exe 41 PID 1736 wrote to memory of 992 1736 rundll32.exe 41 PID 1736 wrote to memory of 992 1736 rundll32.exe 41
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nequ_020B0000.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nequ_020B0000.bin.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\jnsqclsfxra.dll",Updt3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:992
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Roaming\jnsqclsfxra.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:648
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:784
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:688
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:316
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:804
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1380
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1636
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:744
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5761133c5c6e784c5c0fd4aaa2a5ff098
SHA1ca026ff9f9b72e474bb2b7c6d13482f70d633f85
SHA256cb11cb8ab32947189ba764189506789bcb73cc3355f9f40f74944a1fe60f5477
SHA5128a5461bafcda1e5bffe4b104c9c272c3d5ca3f198b1655abf9f55c48aa970a6ec5b7da815f6a7d941f98a512fca1b448a0948f40678e43fcce8198753cc2a609
-
Filesize
2.0MB
MD535dfa07872a3f66411c07c952c38e6a2
SHA14d73d0c3824cc3d2c4743c8df8d1f32ea32d7f90
SHA256103c930565aea6c69e118a16d1618e1d34a816623efd549ed09161d00de4568a
SHA51266ca19883bc3fb8d30845b66b910d16242eab856c98b7783c3cedd1dad9f08a0390686950814c39ed7dcb50012b4503c8026f13f723fdd2dd39c56054945860b
-
Filesize
2.0MB
MD535dfa07872a3f66411c07c952c38e6a2
SHA14d73d0c3824cc3d2c4743c8df8d1f32ea32d7f90
SHA256103c930565aea6c69e118a16d1618e1d34a816623efd549ed09161d00de4568a
SHA51266ca19883bc3fb8d30845b66b910d16242eab856c98b7783c3cedd1dad9f08a0390686950814c39ed7dcb50012b4503c8026f13f723fdd2dd39c56054945860b
-
Filesize
2.0MB
MD535dfa07872a3f66411c07c952c38e6a2
SHA14d73d0c3824cc3d2c4743c8df8d1f32ea32d7f90
SHA256103c930565aea6c69e118a16d1618e1d34a816623efd549ed09161d00de4568a
SHA51266ca19883bc3fb8d30845b66b910d16242eab856c98b7783c3cedd1dad9f08a0390686950814c39ed7dcb50012b4503c8026f13f723fdd2dd39c56054945860b
-
Filesize
2.0MB
MD535dfa07872a3f66411c07c952c38e6a2
SHA14d73d0c3824cc3d2c4743c8df8d1f32ea32d7f90
SHA256103c930565aea6c69e118a16d1618e1d34a816623efd549ed09161d00de4568a
SHA51266ca19883bc3fb8d30845b66b910d16242eab856c98b7783c3cedd1dad9f08a0390686950814c39ed7dcb50012b4503c8026f13f723fdd2dd39c56054945860b
-
Filesize
2.0MB
MD535dfa07872a3f66411c07c952c38e6a2
SHA14d73d0c3824cc3d2c4743c8df8d1f32ea32d7f90
SHA256103c930565aea6c69e118a16d1618e1d34a816623efd549ed09161d00de4568a
SHA51266ca19883bc3fb8d30845b66b910d16242eab856c98b7783c3cedd1dad9f08a0390686950814c39ed7dcb50012b4503c8026f13f723fdd2dd39c56054945860b