Resubmissions
27/12/2022, 14:30
221227-rt6w2aab9s1027/12/2022, 14:29
221227-rt3jlsfa431027/12/2022, 12:27
221227-pmp9laeh371027/12/2022, 12:24
221227-pk183saa9s10Analysis
- max time kernel
149s - max time network
33s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system - submitted
27/12/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
user.dll
Resource
win7-20221111-en
windows7-x64
General
- Target user.dll
- Size 2.0MB
- Sample221227-rt3jlsfa43
- SHA256 c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf
- MD5 37bf163c9a37e27cdbb8c5db31457063
- SHA1 6e5a4df996ffefd5ef01ff8a13913ec09ba404da
- SHA512 131dfdc3f1e648718887648690f0631bd6d77e137d2562aa47d5abec058dcde93f2c3f12bc82ca487d3d60285c126707eae414738f04e20325c599fab3ae072b
- SSDEEP 49152:TDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:/VVnnP8XLQL2q1YSu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.62
-
BB11
-
1671561386
-
184.68.116.146:3389
-
92.189.214.236:2222
-
73.29.92.128:443
-
92.239.81.124:443
-
47.203.227.114:443
-
199.83.165.233:443
-
12.172.173.82:995
-
12.172.173.82:50001
-
136.244.25.165:443
-
37.15.128.31:2222
-
91.96.249.3:443
-
92.27.86.48:2222
-
75.156.125.215:995
-
93.147.134.85:443
-
86.176.246.195:2222
-
89.129.109.27:2222
-
70.55.120.16:2222
-
50.67.17.92:443
-
78.92.133.215:443
-
190.100.149.122:995
-
86.183.251.169:2222
-
184.68.116.146:2222
-
217.43.16.149:443
-
208.180.17.32:2222
-
75.143.236.149:443
-
70.64.77.115:443
-
76.184.95.190:993
-
73.161.176.218:443
-
84.35.26.14:995
-
67.235.138.14:443
-
206.166.209.170:2222
-
108.6.249.139:443
-
70.51.136.204:2222
-
67.253.226.137:995
-
201.137.206.40:443
-
176.44.121.220:995
-
31.48.67.240:443
-
80.103.77.44:2222
-
86.160.253.56:443
-
184.68.116.146:2078
-
76.80.180.154:995
-
181.118.183.50:443
-
173.178.151.233:443
-
72.80.7.6:995
-
109.220.196.24:2222
-
47.34.30.133:443
-
76.170.252.153:995
-
12.172.173.82:21
-
216.36.153.248:443
-
70.77.116.233:443
-
47.41.154.250:443
-
108.162.6.34:443
-
50.68.204.71:443
-
24.69.84.237:443
-
87.65.160.87:995
-
73.36.196.11:443
-
76.68.151.148:2222
-
89.203.252.238:443
-
81.131.210.167:443
-
96.255.66.51:995
-
12.172.173.82:465
-
95.23.15.84:2222
-
67.61.71.201:443
-
66.191.69.18:995
-
51.211.219.211:443
-
79.13.202.140:443
-
77.86.98.236:443
-
70.115.104.126:995
-
152.170.17.136:443
-
70.120.228.205:443
-
178.153.5.54:443
-
12.172.173.82:20
-
91.254.132.23:443
-
72.88.245.71:443
-
45.230.169.132:995
-
142.118.49.193:2222
-
65.95.85.172:2222
-
136.35.241.159:443
-
69.159.156.133:2222
-
92.8.187.85:2222
-
69.133.162.35:443
-
184.68.116.146:50010
-
86.130.9.250:2222
-
149.74.159.67:2222
-
176.133.4.230:995
-
46.10.198.106:443
-
2.14.96.234:2222
-
78.101.91.215:2222
-
92.154.45.81:2222
-
79.77.142.22:2222
-
12.172.173.82:22
-
12.172.173.82:32101
-
90.66.229.185:2222
-
86.225.214.138:2222
-
173.18.126.3:443
-
174.104.184.149:443
-
90.89.95.158:2222
-
162.248.14.107:443
-
190.249.241.149:443
-
78.18.42.55:443
-
184.68.116.146:61202
-
64.123.103.123:443
-
12.172.173.82:990
-
38.166.221.92:2087
-
184.176.154.83:995
-
92.207.132.174:2222
-
75.98.154.19:443
-
142.161.27.232:2222
-
84.113.121.103:443
-
90.104.22.28:2222
-
75.84.234.68:443
-
198.2.51.242:993
-
86.139.213.115:443
-
50.68.204.71:993
-
201.210.114.115:993
-
71.31.101.183:443
-
74.33.196.114:443
-
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 824 rundll32.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe 764 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 824 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 1700 wrote to memory of 824 1700 rundll32.exe 28 PID 824 wrote to memory of 764 824 rundll32.exe 29 PID 824 wrote to memory of 764 824 rundll32.exe 29 PID 824 wrote to memory of 764 824 rundll32.exe 29 PID 824 wrote to memory of 764 824 rundll32.exe 29 PID 824 wrote to memory of 764 824 rundll32.exe 29 PID 824 wrote to memory of 764 824 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-