edc0c5d05fdf66a9f482c60292c6fe98e8e81f8817d722d8545539fa2ac57fa4 | Triage

Resubmissions

31/01/2023, 18:30

230131-w5xvqahf27 10

31/01/2023, 18:16

230131-wwy2eshe77 3

31/01/2023, 17:51

230131-wfchgsbd2v 3

31/01/2023, 17:49

230131-wd521shd85 3

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 17:51

Sharing

Report Analysis Logs

General

Target

Qakbot.dll
Size

713KB
MD5

ea01b105c2c1bb90559bea2cd3df26fe
SHA1

cf73e2502f7976288857d81adf812b1b0c7c55d0
SHA256

4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
SHA512

698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	1272	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1740 wrote to memory of 1272	1740	rundll32.exe	27
PID 1272 wrote to memory of 1200	1272	rundll32.exe	28
PID 1272 wrote to memory of 1200	1272	rundll32.exe	28
PID 1272 wrote to memory of 1200	1272	rundll32.exe	28
PID 1272 wrote to memory of 1200	1272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 228
    3⤵
    - Program crash
    PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download