Resubmissions
27/12/2022, 14:30
221227-rt6w2aab9s1027/12/2022, 14:29
221227-rt3jlsfa431027/12/2022, 12:27
221227-pmp9laeh371027/12/2022, 12:24
221227-pk183saa9s10Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/12/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
user.dll
Resource
win7-20221111-en
windows7-x64
General
- Target user.dll
- Size 2.0MB
- Sample221227-rt3jlsfa43
- SHA256 c08675ecfcb06a2b57b946051d3a63693e4a1de9a33cc98f0cb8a50205906edf
- MD5 37bf163c9a37e27cdbb8c5db31457063
- SHA1 6e5a4df996ffefd5ef01ff8a13913ec09ba404da
- SHA512 131dfdc3f1e648718887648690f0631bd6d77e137d2562aa47d5abec058dcde93f2c3f12bc82ca487d3d60285c126707eae414738f04e20325c599fab3ae072b
- SSDEEP 49152:TDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:/VVnnP8XLQL2q1YSu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.62
-
BB11
-
1671561386
-
184.68.116.146:3389
-
92.189.214.236:2222
-
73.29.92.128:443
-
92.239.81.124:443
-
47.203.227.114:443
-
199.83.165.233:443
-
12.172.173.82:995
-
12.172.173.82:50001
-
136.244.25.165:443
-
37.15.128.31:2222
-
91.96.249.3:443
-
92.27.86.48:2222
-
75.156.125.215:995
-
93.147.134.85:443
-
86.176.246.195:2222
-
89.129.109.27:2222
-
70.55.120.16:2222
-
50.67.17.92:443
-
78.92.133.215:443
-
190.100.149.122:995
-
86.183.251.169:2222
-
184.68.116.146:2222
-
217.43.16.149:443
-
208.180.17.32:2222
-
75.143.236.149:443
-
70.64.77.115:443
-
76.184.95.190:993
-
73.161.176.218:443
-
84.35.26.14:995
-
67.235.138.14:443
-
206.166.209.170:2222
-
108.6.249.139:443
-
70.51.136.204:2222
-
67.253.226.137:995
-
201.137.206.40:443
-
176.44.121.220:995
-
31.48.67.240:443
-
80.103.77.44:2222
-
86.160.253.56:443
-
184.68.116.146:2078
-
76.80.180.154:995
-
181.118.183.50:443
-
173.178.151.233:443
-
72.80.7.6:995
-
109.220.196.24:2222
-
47.34.30.133:443
-
76.170.252.153:995
-
12.172.173.82:21
-
216.36.153.248:443
-
70.77.116.233:443
-
47.41.154.250:443
-
108.162.6.34:443
-
50.68.204.71:443
-
24.69.84.237:443
-
87.65.160.87:995
-
73.36.196.11:443
-
76.68.151.148:2222
-
89.203.252.238:443
-
81.131.210.167:443
-
96.255.66.51:995
-
12.172.173.82:465
-
95.23.15.84:2222
-
67.61.71.201:443
-
66.191.69.18:995
-
51.211.219.211:443
-
79.13.202.140:443
-
77.86.98.236:443
-
70.115.104.126:995
-
152.170.17.136:443
-
70.120.228.205:443
-
178.153.5.54:443
-
12.172.173.82:20
-
91.254.132.23:443
-
72.88.245.71:443
-
45.230.169.132:995
-
142.118.49.193:2222
-
65.95.85.172:2222
-
136.35.241.159:443
-
69.159.156.133:2222
-
92.8.187.85:2222
-
69.133.162.35:443
-
184.68.116.146:50010
-
86.130.9.250:2222
-
149.74.159.67:2222
-
176.133.4.230:995
-
46.10.198.106:443
-
2.14.96.234:2222
-
78.101.91.215:2222
-
92.154.45.81:2222
-
79.77.142.22:2222
-
12.172.173.82:22
-
12.172.173.82:32101
-
90.66.229.185:2222
-
86.225.214.138:2222
-
173.18.126.3:443
-
174.104.184.149:443
-
90.89.95.158:2222
-
162.248.14.107:443
-
190.249.241.149:443
-
78.18.42.55:443
-
184.68.116.146:61202
-
64.123.103.123:443
-
12.172.173.82:990
-
38.166.221.92:2087
-
184.176.154.83:995
-
92.207.132.174:2222
-
75.98.154.19:443
-
142.161.27.232:2222
-
84.113.121.103:443
-
90.104.22.28:2222
-
75.84.234.68:443
-
198.2.51.242:993
-
86.139.213.115:443
-
50.68.204.71:993
-
201.210.114.115:993
-
71.31.101.183:443
-
74.33.196.114:443
-
87.252.106.197:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 rundll32.exe 2548 rundll32.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe 4676 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2548 rundll32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4020 wrote to memory of 2548 4020 rundll32.exe 80 PID 4020 wrote to memory of 2548 4020 rundll32.exe 80 PID 4020 wrote to memory of 2548 4020 rundll32.exe 80 PID 2548 wrote to memory of 4676 2548 rundll32.exe 81 PID 2548 wrote to memory of 4676 2548 rundll32.exe 81 PID 2548 wrote to memory of 4676 2548 rundll32.exe 81 PID 2548 wrote to memory of 4676 2548 rundll32.exe 81 PID 2548 wrote to memory of 4676 2548 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-