Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2022, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
nequ_020B0000.bin.dll
Resource
win7-20220812-en
General
-
Target
nequ_020B0000.bin.dll
-
Size
2.1MB
-
MD5
b12e01985b5daecc58d7cec5b37462ed
-
SHA1
a8654d9b674a330db1f0c8881d678687ab53a0b7
-
SHA256
012747575632a83c77d73b90450612446664d78c5a6a1af082c5da1485f6e9e1
-
SHA512
069685718c6ba4737fd9fb97dc1c36aad80fa75cab171ee88b1cddb145107798a21f53812d1c3483eb6548a1b1ad64bbda5cdc6f08ce1aa46540146379b055f3
-
SSDEEP
49152:SWZ5HwJW2sYVMxHqAHIferky/njn/r8CU36+eRNl:SWZ5HwJDdVCQerRjn/rZU3KR
Malware Config
Extracted
qakbot
404.62
BB11
1671561386
184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4836 rundll32.exe -
Runs ping.exe 1 TTPs 10 IoCs
pid Process 4720 PING.EXE 2448 PING.EXE 3080 PING.EXE 2224 PING.EXE 3616 PING.EXE 3496 PING.EXE 4536 PING.EXE 4268 PING.EXE 400 PING.EXE 1628 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 rundll32.exe 4836 rundll32.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe 4688 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4836 rundll32.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4844 4888 rundll32.exe 82 PID 4888 wrote to memory of 4844 4888 rundll32.exe 82 PID 4888 wrote to memory of 4844 4888 rundll32.exe 82 PID 4844 wrote to memory of 4836 4844 rundll32.exe 83 PID 4844 wrote to memory of 4836 4844 rundll32.exe 83 PID 4844 wrote to memory of 4836 4844 rundll32.exe 83 PID 4836 wrote to memory of 4688 4836 rundll32.exe 84 PID 4836 wrote to memory of 4688 4836 rundll32.exe 84 PID 4836 wrote to memory of 4688 4836 rundll32.exe 84 PID 4836 wrote to memory of 4688 4836 rundll32.exe 84 PID 4836 wrote to memory of 4688 4836 rundll32.exe 84 PID 4844 wrote to memory of 2284 4844 rundll32.exe 87 PID 4844 wrote to memory of 2284 4844 rundll32.exe 87 PID 4844 wrote to memory of 2284 4844 rundll32.exe 87 PID 2284 wrote to memory of 4268 2284 cmd.exe 89 PID 2284 wrote to memory of 4268 2284 cmd.exe 89 PID 2284 wrote to memory of 4268 2284 cmd.exe 89 PID 2284 wrote to memory of 4720 2284 cmd.exe 91 PID 2284 wrote to memory of 4720 2284 cmd.exe 91 PID 2284 wrote to memory of 4720 2284 cmd.exe 91 PID 2284 wrote to memory of 2448 2284 cmd.exe 92 PID 2284 wrote to memory of 2448 2284 cmd.exe 92 PID 2284 wrote to memory of 2448 2284 cmd.exe 92 PID 2284 wrote to memory of 400 2284 cmd.exe 94 PID 2284 wrote to memory of 400 2284 cmd.exe 94 PID 2284 wrote to memory of 400 2284 cmd.exe 94 PID 2284 wrote to memory of 3080 2284 cmd.exe 95 PID 2284 wrote to memory of 3080 2284 cmd.exe 95 PID 2284 wrote to memory of 3080 2284 cmd.exe 95 PID 2284 wrote to memory of 2224 2284 cmd.exe 96 PID 2284 wrote to memory of 2224 2284 cmd.exe 96 PID 2284 wrote to memory of 2224 2284 cmd.exe 96 PID 2284 wrote to memory of 3616 2284 cmd.exe 99 PID 2284 wrote to memory of 3616 2284 cmd.exe 99 PID 2284 wrote to memory of 3616 2284 cmd.exe 99 PID 2284 wrote to memory of 3496 2284 cmd.exe 100 PID 2284 wrote to memory of 3496 2284 cmd.exe 100 PID 2284 wrote to memory of 3496 2284 cmd.exe 100 PID 2284 wrote to memory of 4536 2284 cmd.exe 101 PID 2284 wrote to memory of 4536 2284 cmd.exe 101 PID 2284 wrote to memory of 4536 2284 cmd.exe 101 PID 2284 wrote to memory of 1628 2284 cmd.exe 102 PID 2284 wrote to memory of 1628 2284 cmd.exe 102 PID 2284 wrote to memory of 1628 2284 cmd.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nequ_020B0000.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\nequ_020B0000.bin.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\nnvuaunqzezko.dll",Updt3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Roaming\nnvuaunqzezko.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4720
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:400
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3080
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2224
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3616
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3496
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1628
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5761133c5c6e784c5c0fd4aaa2a5ff098
SHA1ca026ff9f9b72e474bb2b7c6d13482f70d633f85
SHA256cb11cb8ab32947189ba764189506789bcb73cc3355f9f40f74944a1fe60f5477
SHA5128a5461bafcda1e5bffe4b104c9c272c3d5ca3f198b1655abf9f55c48aa970a6ec5b7da815f6a7d941f98a512fca1b448a0948f40678e43fcce8198753cc2a609
-
Filesize
2.0MB
MD5be8307c97004a2cebabfade41c6bcdba
SHA1adf76bafee3a191169217a039b1bbae08786acb0
SHA2562a009bea32f5c812417d8c9d91bd06f0b10e877356a82930a87dbdfb3f4a705e
SHA512f96cef3c2f6b64f381392443e14aafedec43285e7d0c335f28b88fdd7b9a5e13311a113a024dcfcf4ccc0b2f9a58bac01a22137d3077b684ab6643a4289d8609
-
Filesize
2.0MB
MD5be8307c97004a2cebabfade41c6bcdba
SHA1adf76bafee3a191169217a039b1bbae08786acb0
SHA2562a009bea32f5c812417d8c9d91bd06f0b10e877356a82930a87dbdfb3f4a705e
SHA512f96cef3c2f6b64f381392443e14aafedec43285e7d0c335f28b88fdd7b9a5e13311a113a024dcfcf4ccc0b2f9a58bac01a22137d3077b684ab6643a4289d8609