Analysis
-
max time kernel
151s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 08:56
Static task
static1
Behavioral task
behavioral1
Sample
1.png.dll
Resource
win7-20221111-en
General
-
Target
1.png.dll
-
Size
464KB
-
MD5
4a1fbd71010494ad1cb579cd6c395c80
-
SHA1
fd97b9875641a5eb8b95b716fb17d1d36ff81afd
-
SHA256
26a5c35034800e786a979358b4cd86cc15ddef9abdf711fd2d3cd38ba59ee4c2
-
SHA512
0de3b1d693ccc0053ddeb2dc15bb5f0f3bcea47ee3168f8e37202b52bbee482ba1385827954200e814f9c418d4c946dd2b5262ca9984a45075410fbce2bcb79d
-
SSDEEP
6144:C3P9EKUug7ptz0KE05TG2mLsh0H7wiWsxhQsjdDKlos8Wno8Kdygm/K+VybKK:iEKU/I8kLFUi/sRJKYK+4bKK
Malware Config
Extracted
qakbot
404.432
BB12
1675352134
213.67.255.57:2222
86.96.72.139:2222
119.82.122.226:443
86.96.34.182:2222
12.172.173.82:50001
107.146.12.26:2222
97.116.78.96:443
47.61.70.188:2078
197.148.17.17:2078
82.127.204.82:2222
82.121.195.187:2222
73.155.10.79:443
91.231.173.199:995
86.196.12.21:2222
90.78.51.182:2222
90.165.109.4:2222
202.186.177.88:443
92.27.86.48:2222
88.171.156.150:50000
78.130.215.67:443
70.66.199.12:443
47.203.227.114:443
162.248.14.107:443
75.98.154.19:443
83.248.199.56:443
64.237.207.9:443
82.36.36.76:443
183.82.112.209:443
98.145.23.67:443
70.77.116.233:443
49.245.127.223:2222
105.99.105.0:443
209.142.97.83:995
74.33.196.114:443
75.156.125.215:995
189.222.55.8:443
70.160.80.210:443
194.166.90.227:443
12.172.173.82:20
12.172.173.82:995
91.68.227.219:443
91.170.115.68:32100
70.51.133.160:2222
90.104.22.28:2222
86.161.143.7:2222
173.76.49.61:443
24.64.112.40:2222
92.154.45.81:2222
84.219.213.130:6881
47.21.51.138:995
86.130.9.182:2222
78.16.206.181:443
217.128.91.196:2222
74.214.61.68:443
92.239.81.124:443
72.188.121.121:443
181.118.206.65:995
200.109.207.186:2222
12.172.173.82:465
86.165.225.227:2222
208.180.17.32:2222
24.64.112.40:50010
184.153.132.82:443
151.65.168.222:443
72.80.7.6:995
79.9.64.37:995
174.104.184.149:443
24.64.112.40:3389
81.151.102.224:443
108.2.111.66:995
47.34.30.133:443
50.68.204.71:993
123.3.240.16:995
103.12.133.134:2222
47.196.203.73:443
73.165.119.20:443
86.172.79.135:443
41.250.182.207:443
217.128.200.114:2222
47.6.243.7:443
156.217.208.137:995
12.172.173.82:32101
73.36.196.11:443
173.18.126.3:443
81.229.117.95:2222
190.191.35.122:443
84.35.26.14:995
37.14.229.220:2222
90.162.45.154:2222
24.71.120.191:443
86.225.214.138:2222
172.90.139.138:2222
92.207.132.174:2222
217.165.235.126:443
104.35.24.154:443
69.159.158.183:2222
24.123.211.131:443
67.61.71.201:443
86.194.156.14:2222
197.14.77.92:443
184.189.41.80:443
103.169.83.89:443
86.151.21.134:2222
23.251.92.57:2222
71.31.101.183:443
99.254.167.145:443
198.2.51.242:993
76.80.180.154:995
92.11.194.53:995
88.126.94.4:50000
121.121.100.207:995
92.154.17.149:2222
74.92.243.113:50000
68.150.18.161:443
69.119.123.159:2222
50.68.204.71:995
93.238.63.3:995
201.244.108.183:995
92.8.190.175:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 1508 rundll32.exe 1508 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1508 rundll32.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe 1484 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1508 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1508 1612 rundll32.exe rundll32.exe PID 1508 wrote to memory of 1316 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1316 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1316 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1316 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe PID 1508 wrote to memory of 1484 1508 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1.png.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1.png.dll,#12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\13395813.dllFilesize
268KB
MD553bb811ed12d2c867b354390fabf9612
SHA181b29c540c0e2a09385cf7e821639ff64fbffd91
SHA256a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133
SHA5125f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24
-
\Users\Admin\AppData\Local\Temp\4A53C66B.dllFilesize
268KB
MD553bb811ed12d2c867b354390fabf9612
SHA181b29c540c0e2a09385cf7e821639ff64fbffd91
SHA256a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133
SHA5125f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24
-
memory/1484-60-0x0000000000000000-mapping.dmp
-
memory/1484-63-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1484-64-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1508-54-0x0000000000000000-mapping.dmp
-
memory/1508-55-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1508-56-0x0000000000790000-0x00000000007F9000-memory.dmpFilesize
420KB
-
memory/1508-57-0x00000000006F0000-0x0000000000713000-memory.dmpFilesize
140KB
-
memory/1508-62-0x00000000006F0000-0x0000000000713000-memory.dmpFilesize
140KB