Resubmissions
27/12/2022, 14:30
221227-rt6w2aab9s 1027/12/2022, 14:29
221227-rt3jlsfa43 1027/12/2022, 12:27
221227-pmp9laeh37 1027/12/2022, 12:24
221227-pk183saa9s 10Analysis
-
max time kernel
125s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/12/2022, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
user.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
user.dll
-
Size
2.0MB
-
MD5
37bf163c9a37e27cdbb8c5db31457063
-
SHA1
6e5a4df996ffefd5ef01ff8a13913ec09ba404da
-
SHA256
c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf
-
SHA512
131dfdc3f1e648718887648690f0631bd6d77e137d2562aa47d5abec058dcde93f2c3f12bc82ca487d3d60285c126707eae414738f04e20325c599fab3ae072b
-
SSDEEP
49152:TDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:/VVnnP8XLQL2q1YSu
Malware Config
Extracted
qakbot
404.62
BB11
1671561386
184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1644 rundll32.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1776 taskmgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe 1500 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1644 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 1708 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1708 AUDIODG.EXE Token: 33 1708 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1708 AUDIODG.EXE Token: SeDebugPrivilege 1776 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe 1776 taskmgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1672 wrote to memory of 1644 1672 rundll32.exe 27 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28 PID 1644 wrote to memory of 1500 1644 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:560
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4141⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1776
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:768