Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/01/2023, 18:30
230131-w5xvqahf27 1031/01/2023, 18:16
230131-wwy2eshe77 331/01/2023, 17:51
230131-wfchgsbd2v 331/01/2023, 17:49
230131-wd521shd85 3Analysis
-
max time kernel
228s -
max time network
176s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31/01/2023, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
Qakbot.dll
Resource
win10-20220812-en
2 signatures
300 seconds
General
-
Target
Qakbot.dll
-
Size
713KB
-
MD5
ea01b105c2c1bb90559bea2cd3df26fe
-
SHA1
cf73e2502f7976288857d81adf812b1b0c7c55d0
-
SHA256
4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
-
SHA512
698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
-
SSDEEP
12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1420 2504 WerFault.exe 66 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2504 2352 rundll32.exe 66 PID 2352 wrote to memory of 2504 2352 rundll32.exe 66 PID 2352 wrote to memory of 2504 2352 rundll32.exe 66
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#12⤵PID:2504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 6163⤵
- Program crash
PID:1420
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:4144
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3084