Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/01/2023, 18:30
230131-w5xvqahf27 1031/01/2023, 18:16
230131-wwy2eshe77 331/01/2023, 17:51
230131-wfchgsbd2v 331/01/2023, 17:49
230131-wd521shd85 3Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2023, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
Qakbot.dll
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Qakbot.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
Qakbot.dll
-
Size
713KB
-
MD5
ea01b105c2c1bb90559bea2cd3df26fe
-
SHA1
cf73e2502f7976288857d81adf812b1b0c7c55d0
-
SHA256
4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
-
SHA512
698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
-
SSDEEP
12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4300 4900 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4244 wrote to memory of 4900 4244 rundll32.exe 82 PID 4244 wrote to memory of 4900 4244 rundll32.exe 82 PID 4244 wrote to memory of 4900 4244 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#12⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 6003⤵
- Program crash
PID:4300
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 49001⤵PID:4356