Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2023 18:36
Static task
static1
Behavioral task
behavioral1
Sample
parallax-systems.com.dll
Resource
win7-20230220-en
windows7-x64
General
-
Target
parallax-systems.com.dll
-
Size
524KB
-
MD5
c3c2565c1401b5a436291df479ae7d28
-
SHA1
59fde9dcf2b51d6f4e07068f31f54ec5248bf4b6
-
SHA256
e97d0fef27fe3e831bd23cf2ac654f06bf9ec2f2d3a59593431d62e3d15b878d
-
SHA512
a322cded7846a9d5b6b848287dab128607c17e4ed43983b68f396839eb39e4d6379d4bf8d5278bc09fd88e183f3de0e7dfe37d9a5879291e9fef37d64d33ad14
-
SSDEEP
6144:9kIzvcd6bpkttJtlXWPFuXwkj2Zlx2Un8sLjA:mgcbttDlXWPkwkj4xLtLjA
Malware Config
Extracted
qakbot
404.226
BB18
1678346017
114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 rundll32.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe 1832 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1980 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1064 wrote to memory of 1980 1064 rundll32.exe 27 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28 PID 1980 wrote to memory of 1832 1980 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\parallax-systems.com.dll XL551⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\parallax-systems.com.dll XL552⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-