Analysis
-
max time kernel
99s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 12:35
Static task
static1
Behavioral task
behavioral1
Sample
publish/eardrum.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
publish/eardrum.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
publish/overawesBets.vbs
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
publish/overawesBets.vbs
Resource
win10v2004-20220812-en
General
-
Target
publish/eardrum.dll
-
Size
472KB
-
MD5
f24a452723c7e5d1f85eab7f5ec7ecd9
-
SHA1
2596f834041095c888b45e61ca48df3d4ce3a99d
-
SHA256
1abc2fb23f55378947bf528996b50ffed195a059d5f7b537271792704eb5cd4c
-
SHA512
a366c9f17df14ac093ea41ec248476a02b70051efacfe4fd654ef5461200bff18dc653d852eb4e2ee8eb722bd3917055bcf85c923dd46e8c262107f71045d56f
-
SSDEEP
6144:icJ88bsBZpZKeiJb1pPMkKvHrdTcf7CsHW8kYTRapUQsJT8Td++seeAOA0Y:VJDoBZjFibAOTCs28k2gN/rea0Y
Malware Config
Extracted
qakbot
403.902
BB
1664801691
160.179.220.87:995
186.86.212.138:443
180.180.213.94:995
186.125.93.28:443
31.167.72.198:443
78.162.213.155:443
46.10.105.160:443
41.105.54.8:443
41.108.175.56:443
188.156.85.37:443
94.52.127.44:443
79.168.151.143:443
189.79.27.174:995
179.178.249.16:443
23.225.104.250:443
134.35.11.71:443
197.204.126.136:443
197.205.168.243:443
58.186.75.42:443
41.96.18.5:443
102.158.33.255:443
185.253.160.134:2222
154.183.135.35:995
105.108.255.165:443
41.98.6.9:443
41.97.255.75:443
175.110.43.48:443
73.252.27.208:995
14.230.246.158:443
149.126.159.254:443
41.69.107.192:995
78.187.65.132:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1232 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1232 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1388 wrote to memory of 1232 1388 regsvr32.exe regsvr32.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe PID 1232 wrote to memory of 692 1232 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\eardrum.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\publish\eardrum.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵PID:692
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-59-0x0000000000000000-mapping.dmp
-
memory/692-61-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1232-55-0x0000000000000000-mapping.dmp
-
memory/1232-56-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1232-57-0x00000000004A0000-0x0000000000520000-memory.dmpFilesize
512KB
-
memory/1232-58-0x00000000004A0000-0x0000000000520000-memory.dmpFilesize
512KB
-
memory/1388-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmpFilesize
8KB