Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2022, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
51fa313f462778fff433ce7937d56f8fbe0809b7dde688991bb5f89a3ad883c6.dll
Resource
win7-20220901-en
General
-
Target
51fa313f462778fff433ce7937d56f8fbe0809b7dde688991bb5f89a3ad883c6.dll
-
Size
2.0MB
-
MD5
ebd02dceef48896466915d3c8c4d0b2d
-
SHA1
efcb5dd08e26c621b82400e3cc05fd330d796afb
-
SHA256
51fa313f462778fff433ce7937d56f8fbe0809b7dde688991bb5f89a3ad883c6
-
SHA512
8964f5037a2e0bd4c0801c729ff0f89d8819049da09f8695b7f3618c06a0c3f70ec06bb94d4343eadeb36e00f7d1592bd0c1ad1b6b64762a1b010bde6aa046b0
-
SSDEEP
49152:fDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:rVVnnP8XLQL2q1YSu
Malware Config
Extracted
qakbot
404.62
BB11
1671561386
184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 rundll32.exe 2008 rundll32.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe 1796 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2008 3464 rundll32.exe 79 PID 3464 wrote to memory of 2008 3464 rundll32.exe 79 PID 3464 wrote to memory of 2008 3464 rundll32.exe 79 PID 2008 wrote to memory of 1796 2008 rundll32.exe 80 PID 2008 wrote to memory of 1796 2008 rundll32.exe 80 PID 2008 wrote to memory of 1796 2008 rundll32.exe 80 PID 2008 wrote to memory of 1796 2008 rundll32.exe 80 PID 2008 wrote to memory of 1796 2008 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51fa313f462778fff433ce7937d56f8fbe0809b7dde688991bb5f89a3ad883c6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51fa313f462778fff433ce7937d56f8fbe0809b7dde688991bb5f89a3ad883c6.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
-