Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2023, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
ee6b3a12f486007ab1771c5a48fbab506538f2a6c16e4b13b8ba2711cdb306c6.dll
Resource
win7-20230220-en
General
-
Target
ee6b3a12f486007ab1771c5a48fbab506538f2a6c16e4b13b8ba2711cdb306c6.dll
-
Size
357KB
-
MD5
21bdb6d725536baf5f1b592bcccabc81
-
SHA1
494fd7409da700b469ad3c9f5259e823a45e9f51
-
SHA256
ee6b3a12f486007ab1771c5a48fbab506538f2a6c16e4b13b8ba2711cdb306c6
-
SHA512
70dc54b94fab2cb44a7a0f4aff0922e3fd1a22438587b6d1561bd123a1c47fd974cb673792866ebac5f194c5ac721fdee27c41a63b9cb910dcd019fb87d000a1
-
SSDEEP
6144:i4XpMMnVH+R25rka7HNpnbkUds8D1GJR8:RXvVHY25RHbks1GJR8
Malware Config
Extracted
qakbot
404.226
BB18
1678346091
114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1284 1440 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1440 rundll32.exe 1440 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3256 wrote to memory of 1440 3256 rundll32.exe 30 PID 3256 wrote to memory of 1440 3256 rundll32.exe 30 PID 3256 wrote to memory of 1440 3256 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6b3a12f486007ab1771c5a48fbab506538f2a6c16e4b13b8ba2711cdb306c6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee6b3a12f486007ab1771c5a48fbab506538f2a6c16e4b13b8ba2711cdb306c6.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 6123⤵
- Program crash
PID:1284
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1440 -ip 14401⤵PID:2500