edc0c5d05fdf66a9f482c60292c6fe98e8e81f8817d722d8545539fa2ac57fa4 | Triage

Resubmissions

31/01/2023, 18:30

230131-w5xvqahf27 10

31/01/2023, 18:16

230131-wwy2eshe77 3

31/01/2023, 17:51

230131-wfchgsbd2v 3

31/01/2023, 17:49

230131-wd521shd85 3

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2023, 17:51

Sharing

Report Analysis Logs

General

Target

Qakbot.dll
Size

713KB
MD5

ea01b105c2c1bb90559bea2cd3df26fe
SHA1

cf73e2502f7976288857d81adf812b1b0c7c55d0
SHA256

4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
SHA512

698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4300	4900	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4900	4244	rundll32.exe	82
PID 4244 wrote to memory of 4900	4244	rundll32.exe	82
PID 4244 wrote to memory of 4900	4244	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#1
  2⤵
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 600
    3⤵
    - Program crash
    PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads