Analysis
- max time kernel
60s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
18/01/2023, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
2ef58e84c4a9d41b5efbd84308272bc1d38a98eb73d8fdc21b7288beb0cfa530.dll
Resource
win7-20220901-en
windows7-x64
General
- Target 2ef58e84c4a9d41b5efbd84308272bc1d38a98eb73d8fdc21b7288beb0cfa530.dll
- Size 422KB
- Sample230118-vlnx2ade47
- SHA256 2ef58e84c4a9d41b5efbd84308272bc1d38a98eb73d8fdc21b7288beb0cfa530
- MD5 76cdfa8a369a8013766367a5c1dfad3c
- SHA1 2bdfc0d451815db13f9ac76f9fad5062b5e7cd88
- SHA512 8a0a273d82457e736a57dee9178c7db1f39580625e09ea426a4d0ff38a882532a7dfb8e99b227dc9b931b6f59282210487dc3b3f2504a5e744f27504a120237a
- SSDEEP 12288:eqdD/sblafl4M/8toGXJZ6diNjXo8Ywr6t57AKC:eqdclafl4eGXuiNY8Ye6c
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.2
-
BB04
-
1666863946
-
27.110.134.202:995
-
156.220.47.67:993
-
142.115.84.88:2222
-
156.216.134.70:995
-
58.247.115.126:995
-
24.9.220.167:443
-
24.116.45.121:443
-
186.188.80.134:443
-
190.199.101.37:2222
-
24.206.27.39:443
-
181.164.194.228:443
-
105.96.198.88:443
-
112.141.184.246:995
-
64.207.237.118:443
-
118.200.83.226:443
-
149.126.159.224:443
-
181.118.183.124:443
-
144.202.15.58:443
-
172.117.139.142:995
-
200.233.108.153:995
-
109.136.174.200:995
-
193.3.19.137:443
-
201.68.209.47:32101
-
45.48.36.226:2087
-
45.35.97.45:443
-
167.58.254.85:443
-
41.96.102.114:443
-
41.200.117.82:443
-
188.49.56.189:443
-
102.159.110.79:995
-
117.254.35.107:443
-
14.227.159.197:443
-
201.223.169.238:32100
-
181.141.3.126:443
-
70.187.0.87:2078
-
190.74.248.136:443
-
190.199.97.108:993
-
190.24.45.24:995
-
190.37.174.11:2222
-
45.230.169.132:995
-
68.62.199.70:443
-
190.18.236.175:443
-
201.210.92.3:2222
-
186.154.189.162:995
-
97.118.223.249:443
-
105.157.133.175:443
-
151.213.183.141:995
-
45.49.137.80:443
-
70.51.139.148:2222
-
64.123.103.123:443
-
152.170.17.136:443
-
172.112.37.112:2222
-
181.56.171.3:995
-
187.135.132.84:443
-
109.133.67.116:995
-
102.159.236.29:443
-
41.97.169.44:443
-
186.93.152.82:2222
-
70.60.142.214:2222
-
206.1.183.242:443
-
75.84.234.68:443
-
186.48.161.130:995
-
72.88.245.71:443
-
27.109.19.90:2078
-
186.188.96.197:443
-
45.230.169.132:993
-
78.179.135.247:443
-
197.244.36.215:443
-
191.33.187.192:2222
-
41.100.163.127:443
-
220.134.54.185:2222
-
66.170.93.10:443
-
83.244.63.21:443
-
154.237.240.209:995
-
41.47.249.185:443
-
154.181.228.27:995
-
175.205.2.54:443
-
216.131.22.236:995
-
206.1.251.6:443
-
201.249.100.208:995
-
190.33.241.216:443
-
198.2.51.242:993
-
90.165.109.4:2222
-
71.199.168.185:443
-
41.103.27.50:443
-
24.207.97.117:443
-
105.157.86.118:443
-
47.14.229.4:443
-
142.181.183.42:2222
-
41.97.205.96:443
-
186.18.210.16:443
-
41.98.248.133:443
-
160.176.151.70:995
-
98.207.190.55:443
-
196.65.217.253:995
-
78.50.124.220:443
-
91.171.72.214:32100
-
101.109.44.197:995
-
97.92.4.205:8443
-
70.115.104.126:443
-
181.44.34.172:443
-
88.240.75.201:443
-
24.130.228.100:443
-
41.109.228.108:995
-
24.177.111.153:443
-
60.54.65.27:443
-
189.129.38.158:2222
-
222.117.141.133:443
-
105.108.223.181:443
-
41.104.155.245:443
-
65.140.11.170:443
-
184.159.76.47:443
-
105.98.223.169:443
-
197.0.225.39:443
-
105.155.151.29:995
-
196.207.146.151:443
-
190.37.112.223:2222
-
14.54.83.15:443
-
93.156.96.171:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 regsvr32.exe 2128 regsvr32.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe 2456 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2128 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3536 wrote to memory of 2128 3536 regsvr32.exe 80 PID 3536 wrote to memory of 2128 3536 regsvr32.exe 80 PID 3536 wrote to memory of 2128 3536 regsvr32.exe 80 PID 2128 wrote to memory of 2456 2128 regsvr32.exe 84 PID 2128 wrote to memory of 2456 2128 regsvr32.exe 84 PID 2128 wrote to memory of 2456 2128 regsvr32.exe 84 PID 2128 wrote to memory of 2456 2128 regsvr32.exe 84 PID 2128 wrote to memory of 2456 2128 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2ef58e84c4a9d41b5efbd84308272bc1d38a98eb73d8fdc21b7288beb0cfa530.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2ef58e84c4a9d41b5efbd84308272bc1d38a98eb73d8fdc21b7288beb0cfa530.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-