Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07/02/2023, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
01 (2).dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
01 (2).dll
Resource
win10v2004-20221111-en
General
-
Target
01 (2).dll
-
Size
418KB
-
MD5
ab28ce01947066084d4af6583a6d3b54
-
SHA1
b1d69acda90232d836bc69ea3cbd9465ce3afdd3
-
SHA256
73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3
-
SHA512
b99e5f2348f653da27a3ebc53da47dba72fc0b94ceaaf290e8f7d23cf0ef45095c13a9a101b235c6c45873a5feae35eedf402e5ea90bea5f12274cce103ba307
-
SSDEEP
6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT
Malware Config
Extracted
qakbot
404.492
BB14
1675755007
50.68.186.195:443
69.242.31.249:443
88.126.112.14:50000
73.161.176.218:443
87.149.176.97:443
92.154.45.81:2222
50.68.204.71:443
86.195.14.72:2222
136.244.25.165:443
75.143.236.149:443
109.149.147.177:2222
171.97.42.67:443
86.96.72.139:2222
87.202.101.164:50000
104.35.24.154:443
174.104.184.149:443
45.72.110.133:443
12.172.173.82:50001
92.154.17.149:2222
2.14.144.105:2222
72.80.7.6:995
82.127.204.82:2222
86.194.156.14:2222
71.52.53.166:443
89.32.158.118:995
92.186.69.229:2222
103.231.216.238:443
182.180.105.242:443
24.64.112.40:61202
181.118.206.65:995
162.248.14.107:443
75.98.154.19:443
12.172.173.82:995
92.177.204.2:2222
47.21.51.138:995
24.239.69.244:443
73.165.119.20:443
197.204.241.104:443
74.33.196.114:443
70.160.80.210:443
50.68.204.71:993
114.143.176.234:443
12.172.173.82:20
24.64.112.40:2078
103.42.86.238:995
193.154.200.140:443
90.104.22.28:2222
109.11.175.42:2222
200.84.210.63:2222
81.151.102.224:443
12.172.173.82:465
98.145.23.67:443
47.34.30.133:443
172.248.42.122:443
49.175.72.56:443
173.18.126.3:443
24.71.120.191:443
156.217.208.137:995
95.94.41.77:2222
27.0.48.205:443
69.119.123.159:2222
202.186.177.88:443
90.78.138.217:2222
12.172.173.82:32101
72.203.216.98:2222
81.229.117.95:2222
12.172.173.82:2087
76.170.252.153:995
27.0.48.233:443
84.35.26.14:995
73.36.196.11:443
12.172.173.82:990
103.123.221.16:443
86.225.214.138:2222
92.207.132.174:2222
121.121.100.207:995
74.92.243.113:50000
150.107.231.59:2222
71.31.101.183:443
84.215.202.22:443
198.2.51.242:993
92.8.191.120:2222
86.250.12.217:2222
50.68.204.71:995
201.244.108.183:995
202.142.98.62:995
91.170.115.68:32100
202.142.98.62:443
183.87.163.165:443
116.72.250.18:443
114.79.180.14:995
76.80.180.154:995
123.3.240.16:995
100.10.72.114:443
70.64.77.115:443
58.247.115.126:995
103.141.50.151:995
116.75.63.203:443
149.74.159.67:2222
108.2.111.66:995
50.67.17.92:443
80.0.74.165:443
59.28.84.65:443
217.165.186.116:2222
47.21.51.138:443
103.212.19.254:995
136.232.184.134:995
67.61.71.201:443
24.228.132.224:2222
208.187.122.74:443
75.156.125.215:995
70.77.116.233:443
184.155.91.69:443
103.252.7.228:443
67.253.226.137:995
67.10.175.47:2222
70.27.104.2:2222
47.149.95.10:443
209.142.97.83:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3236 1540 WerFault.exe 82 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 msedge.exe 4048 msedge.exe 4452 msedge.exe 4452 msedge.exe 4564 rundll32.exe 4564 rundll32.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe 5328 msra.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4564 rundll32.exe 4564 rundll32.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 1540 3096 rundll32.exe 82 PID 3096 wrote to memory of 1540 3096 rundll32.exe 82 PID 3096 wrote to memory of 1540 3096 rundll32.exe 82 PID 4452 wrote to memory of 4672 4452 msedge.exe 100 PID 4452 wrote to memory of 4672 4452 msedge.exe 100 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4092 4452 msedge.exe 102 PID 4452 wrote to memory of 4048 4452 msedge.exe 103 PID 4452 wrote to memory of 4048 4452 msedge.exe 103 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104 PID 4452 wrote to memory of 5148 4452 msedge.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 (2).dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 (2).dll",#12⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 6003⤵
- Program crash
PID:3236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1540 -ip 15401⤵PID:2704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dcd%2B%2525temp%2525%26form%3DWNSGPH%26qs%3DCT%26cvid%3Dbe83034ab4fd411389d1b73778b74da4%26pq%3Dcd%2B%2525temp%2525%26cc%3DUS%26setlang%3Den-US%26nclid%3DCAC8B5DC7810FF34BE8B0589D9785095%26ts%3D1675793231412%26nclidts%3D1675793231%26tsms%3D412×tamp=1675793231413&source=WindowsSearchBox&campaign=addedgeprot&medium=AutoSuggest1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x78,0x7c,0x80,0x74,0xe4,0x7ffa950146f8,0x7ffa95014708,0x7ffa950147182⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:5148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:5368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5044 /prefetch:82⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11864487523927422114,12204084600486199501,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:5648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5232
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:5972
-
C:\Windows\system32\rundll32.exerundll32.exe "01 (2).dll,Wind2⤵PID:5632
-
-
C:\Windows\system32\rundll32.exerundll32.exe "01 (2).dll,Wind"2⤵PID:5752
-
-
C:\Windows\system32\rundll32.exerundll32.exe "01 (2).dll",wind2⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "01 (2).dll",wind3⤵PID:5168
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "01 (2).dll",Wind2⤵PID:2168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "01 (2).dll",Wind3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4564 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵PID:768
-
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵PID:5200
-
-
C:\Windows\SysWOW64\msra.exeC:\Windows\SysWOW64\msra.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5328
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "01 (2).dll,Wind"2⤵PID:740
-