Resubmissions
16/02/2023, 08:46
230216-kpe47age21 10Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16/02/2023, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
aCl4V.dll
Resource
win7-20220812-en
windows7-x64
General
-
Target
aCl4V.dll
-
Size
582KB
-
MD5
fa8b96610ecc539feb879fa9a1754167
-
SHA1
6921caf3fc7e8b3d116b79fdd5003ba5900ad293
-
SHA256
203b160ee2cd30fa77cbe788ca38dacae21f8982a869e9b8f3e687f62f37f0f6
-
SHA512
3356d3149d85cfc22438702a17227e7bc583707f070051643dd6c6cd12129cb1eebbdb97e0705d2c0c431621e3238aac14d6b85aff7530593385f482922ca0c5
-
SSDEEP
12288:GZa7ZPnVubJS4NjeWC58ryBeLnr2zlTzZ:Ke5VuY1H8rGbTV
Malware Config
Extracted
qakbot
404.510
tzr06
1676466541
82.127.204.82:2222
183.87.163.165:443
50.68.204.71:443
162.248.14.107:443
75.98.154.19:443
86.130.9.232:2222
108.2.111.66:995
85.241.180.94:443
109.150.179.236:2222
73.29.92.128:443
190.206.75.58:2222
12.172.173.82:50001
35.143.97.145:995
174.104.184.149:443
12.172.173.82:995
76.170.252.153:995
73.161.176.218:443
65.190.242.244:443
87.202.101.164:50000
76.64.202.44:2222
75.143.236.149:443
85.61.165.153:2222
181.118.206.65:995
98.145.23.67:443
122.184.143.82:443
87.221.197.113:2222
76.20.42.45:443
86.207.227.152:2222
109.11.175.42:2222
41.228.236.143:995
51.37.173.153:443
24.206.27.39:443
116.72.250.18:443
80.3.209.218:443
82.36.36.76:443
12.172.173.82:2087
176.142.207.63:443
66.35.126.223:2222
24.239.69.244:443
68.108.122.180:443
173.18.126.3:443
156.216.125.255:995
24.71.120.191:443
73.165.119.20:443
41.230.174.134:443
90.104.22.28:2222
74.33.196.114:443
121.121.100.207:995
81.157.227.223:2222
12.172.173.82:20
67.187.130.101:443
172.248.42.122:443
85.85.34.201:993
82.11.242.219:443
93.156.99.48:443
84.35.26.14:995
216.151.184.116:443
12.172.173.82:465
50.68.204.71:993
12.172.173.82:990
12.172.173.82:21
45.50.233.214:443
89.79.229.50:443
47.34.30.133:443
70.27.104.2:2222
47.21.51.138:443
116.75.63.211:443
149.74.159.67:2222
202.142.98.62:995
103.42.86.110:995
103.123.223.76:443
92.27.86.48:2222
213.67.255.57:2222
125.99.69.178:443
193.253.100.236:2222
47.149.78.242:443
71.112.212.166:443
94.3.71.196:443
103.212.19.254:995
217.165.186.116:2222
46.27.231.50:2078
86.96.72.139:2222
64.237.185.60:443
188.83.248.76:443
2.50.48.213:443
85.152.152.46:443
77.86.98.236:443
217.128.91.196:2222
2.13.73.146:2222
27.109.19.90:2078
94.30.98.134:32100
86.128.15.66:2222
86.195.14.72:2222
86.250.12.217:2222
98.37.25.99:443
188.49.125.169:995
86.202.48.142:2222
103.252.7.231:443
86.225.214.138:2222
95.255.60.223:995
74.92.243.113:50000
90.213.146.227:443
92.186.69.229:2222
104.35.24.154:443
201.244.108.183:995
190.75.132.158:2222
184.176.35.223:2222
190.11.198.75:443
82.212.115.188:443
205.164.227.222:443
87.223.82.41:443
88.126.94.4:50000
37.14.229.220:2222
85.59.61.52:2222
147.219.4.194:443
76.80.180.154:995
79.67.165.149:995
103.144.201.53:2078
72.80.7.6:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2044 2028 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 rundll32.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe 1720 msra.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1976 rundll32.exe 1976 rundll32.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1792 wrote to memory of 1976 1792 rundll32.exe 28 PID 1976 wrote to memory of 1748 1976 rundll32.exe 29 PID 1976 wrote to memory of 1748 1976 rundll32.exe 29 PID 1976 wrote to memory of 1748 1976 rundll32.exe 29 PID 1976 wrote to memory of 1748 1976 rundll32.exe 29 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 1976 wrote to memory of 2028 1976 rundll32.exe 30 PID 2028 wrote to memory of 2044 2028 wermgr.exe 31 PID 2028 wrote to memory of 2044 2028 wermgr.exe 31 PID 2028 wrote to memory of 2044 2028 wermgr.exe 31 PID 2028 wrote to memory of 2044 2028 wermgr.exe 31 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32 PID 1976 wrote to memory of 1720 1976 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aCl4V.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aCl4V.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵PID:1748
-
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 1564⤵
- Program crash
PID:2044
-
-
-
C:\Windows\SysWOW64\msra.exeC:\Windows\SysWOW64\msra.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-