edc0c5d05fdf66a9f482c60292c6fe98e8e81f8817d722d8545539fa2ac57fa4 | Triage

Resubmissions

31-01-2023 18:30

230131-w5xvqahf27 10

31-01-2023 18:16

230131-wwy2eshe77 3

31-01-2023 17:51

230131-wfchgsbd2v 3

31-01-2023 17:49

230131-wd521shd85 3

Analysis

max time kernel
60s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2023 17:49

Sharing

Report Analysis Logs

General

Target

Qakbot.dll
Size

713KB
MD5

ea01b105c2c1bb90559bea2cd3df26fe
SHA1

cf73e2502f7976288857d81adf812b1b0c7c55d0
SHA256

4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
SHA512

698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
860	2552	WerFault.exe	81
3456	4388	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2552	4300	rundll32.exe	81
PID 4300 wrote to memory of 2552	4300	rundll32.exe	81
PID 4300 wrote to memory of 2552	4300	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 600
    3⤵
    - Program crash
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2552 -ip 2552
1⤵
PID:4220

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 4388 -ip 4388
1⤵
PID:4936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4388 -s 2196
1⤵
- Program crash
PID:3456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads