Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26/12/2022, 16:29
Static task
static1
Behavioral task
behavioral1
Sample
REPORT_UC0494.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
REPORT_UC0494.lnk
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UpdatedFiles/NewFiles.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
UpdatedFiles/NewFiles.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
UpdatedFiles/NewInvoice.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral6
Sample
UpdatedFiles/NewInvoice.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
UpdatedFiles/NewFiles.cmd
-
Size
11KB
-
MD5
d6d9e42b32b43b39f45335322ffd1552
-
SHA1
f28e8fe4faf2d374df3488f27d01fdaf44d0b776
-
SHA256
35711a9125d3e9601785f1f108383879c2263b15fc1628594884c92f7ddfd968
-
SHA512
4bcb3db3cab427ef036eb99cc5404dfb05f1a585f843cd79fa9ff38bb132572cd15bec22c54767ec7296f9375c183dbfd32e7d1b4e256203a374eb51320a7341
-
SSDEEP
192:0JpPgHxipTFAFTijVD3E6NHJbU9dnGUrBp3EK/O4uAuR/bDGevK:0IxKTkOjtrNHJEdnGqp3vgAutDGX
Malware Config
Extracted
qakbot
404.62
azd
1671805456
79.77.142.22:2222
70.51.134.110:2222
156.217.79.168:995
93.156.98.4:443
108.6.249.139:443
89.152.120.181:443
152.170.17.136:443
83.248.199.56:443
136.35.241.159:443
72.200.109.104:443
84.113.121.103:443
38.166.41.88:2087
173.178.151.233:443
85.72.107.2:2222
91.254.132.23:443
195.198.103.184:443
96.255.66.51:995
178.142.126.181:443
176.142.207.63:443
199.83.165.233:443
93.147.134.85:443
64.237.240.3:443
75.99.125.238:2222
184.68.116.146:3389
184.68.116.146:2222
66.191.69.18:995
92.189.214.236:2222
73.29.92.128:443
188.52.183.146:995
72.88.245.71:443
82.9.210.36:443
175.139.207.179:2222
190.78.77.15:993
73.88.173.113:443
83.7.53.22:443
162.248.14.107:443
86.222.191.162:2222
184.153.132.82:443
81.248.77.37:2222
12.172.173.82:995
12.172.173.82:50001
76.68.151.148:2222
76.20.42.45:443
37.15.128.31:2222
80.98.132.66:443
76.170.252.153:995
12.172.173.82:21
125.20.112.94:443
190.249.241.149:443
109.11.175.42:2222
109.159.119.23:2222
67.235.138.14:443
69.165.145.141:443
183.87.163.165:443
47.34.30.133:443
37.14.229.220:2222
103.141.50.151:995
70.95.236.129:443
41.227.93.13:995
98.187.21.2:443
75.143.236.149:443
92.239.81.124:443
47.16.68.188:2222
84.35.26.14:995
69.159.156.133:2222
108.162.6.34:443
87.65.160.87:995
73.36.196.11:443
12.172.173.82:465
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
2.82.10.152:443
27.109.19.90:2078
80.103.77.44:2222
92.27.86.48:2222
206.166.209.170:2222
181.4.227.82:443
76.80.180.154:995
181.118.183.50:443
200.109.19.59:2222
72.80.7.6:995
184.68.116.146:2078
130.43.90.78:995
88.126.94.4:50000
70.77.116.233:443
50.68.204.71:443
92.186.69.229:2222
150.107.231.59:2222
190.199.157.49:2222
86.160.253.56:443
84.219.213.130:2222
181.118.206.65:995
87.220.205.65:2222
173.209.185.159:443
90.116.219.167:2222
172.248.42.122:443
76.100.159.250:443
24.142.218.202:443
92.8.187.85:2222
2.14.140.222:2222
69.133.162.35:443
83.114.60.6:2222
185.13.180.250:443
50.68.204.71:995
178.153.3.212:443
90.79.129.166:2222
46.24.136.17:2078
89.115.196.99:443
27.99.45.237:2222
147.148.234.231:2222
202.142.98.62:443
86.134.75.5:443
121.121.100.148:995
87.252.106.197:995
172.90.139.138:2222
92.98.72.220:2222
86.96.75.237:2222
202.142.98.62:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1432 rundll32.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe 1724 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1432 rundll32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1564 wrote to memory of 576 1564 cmd.exe 29 PID 1564 wrote to memory of 576 1564 cmd.exe 29 PID 1564 wrote to memory of 576 1564 cmd.exe 29 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 576 wrote to memory of 1432 576 rundll32.exe 30 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31 PID 1432 wrote to memory of 1724 1432 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\UpdatedFiles\NewFiles.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\rundll32.exerundll32 /s newinvoice.sm,Updt2⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\rundll32.exerundll32 /s newinvoice.sm,Updt3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
-