Analysis
-
max time kernel
149s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-04-2023 17:39
Behavioral task
behavioral1
Sample
430000.dll
Resource
win7-20230220-en
General
-
Target
430000.dll
-
Size
130KB
-
MD5
f614498d0e00be7207714bf6de2cf6c1
-
SHA1
afb2cde286628e62ed43db9149e0b93ac27d6866
-
SHA256
1a9018c8a743f206879d99651535a624a9dc56e578666c3e868c5991603da0f7
-
SHA512
1bedfdf52b578a3204cbc0ec2927632d46a2437ae26e1d870833d82730e61dd1327cc7476318d67ee6401fbaf47c43b7f88f159f0f6dbaf3adbcd3afae63070d
-
SSDEEP
3072:Y1CGk7wnQpPYn+/lTS15AJJv6VVHU8TBff4Bzho:YYGkC6QnclaSJJCVVHU8TB349
Malware Config
Extracted
qakbot
404.909
BB22
1680772777
83.77.208.166:2222
47.205.25.170:443
12.172.173.82:995
24.236.90.196:2078
75.109.111.89:443
45.50.233.214:443
86.209.8.236:2222
92.154.17.149:2222
59.153.96.4:443
91.82.133.190:443
197.92.131.255:443
103.42.86.42:995
12.172.173.82:21
73.36.196.11:443
77.126.11.114:443
103.140.174.20:2222
12.172.173.82:465
119.82.123.160:443
116.72.250.18:443
109.50.143.218:2222
2.237.150.131:2222
116.74.163.233:443
72.200.109.104:443
85.61.165.153:2222
92.149.250.113:2222
59.28.84.65:443
87.223.89.244:443
84.35.26.14:995
12.172.173.82:2087
50.68.204.71:995
108.32.72.145:443
90.55.106.37:2222
41.62.194.136:443
70.28.50.223:32100
198.2.51.242:993
75.98.154.19:443
69.133.162.35:443
47.21.51.138:443
49.245.95.124:2222
12.172.173.82:32101
64.121.161.102:443
70.28.50.223:1194
35.143.97.145:995
2.82.8.80:443
92.1.170.110:995
178.175.187.254:443
47.34.30.133:443
86.98.23.66:443
81.229.117.95:2222
184.153.132.82:443
50.68.204.71:443
109.154.254.126:2222
213.67.139.53:2222
172.115.17.50:443
109.159.118.65:2222
144.64.226.144:443
50.68.186.195:443
213.91.235.146:443
186.64.87.204:443
75.143.236.149:443
174.4.89.3:443
71.31.232.65:995
70.28.50.223:2087
36.152.128.5:6883
71.38.155.217:443
70.28.50.223:2083
27.109.19.90:2078
50.68.204.71:993
12.172.173.82:22
76.170.252.153:995
99.228.131.116:2222
81.150.42.123:443
88.122.133.88:32100
86.176.87.35:2222
103.113.68.33:443
74.66.134.24:443
176.142.207.63:443
157.119.85.203:443
103.111.70.66:995
103.111.70.66:443
103.144.201.53:2078
92.239.81.124:443
86.97.66.70:2222
100.6.31.96:443
70.51.153.108:2222
84.215.202.8:443
89.129.109.27:2222
213.66.245.200:2222
151.65.213.208:443
105.184.103.142:995
86.195.14.72:2222
86.45.66.141:2222
174.171.10.179:443
151.51.235.22:443
91.165.188.74:50000
12.172.173.82:20
162.248.14.107:443
72.203.216.98:2222
71.31.100.192:443
90.93.132.149:2222
84.155.13.118:995
112.222.83.147:6881
67.10.2.240:995
70.160.80.210:443
12.172.173.82:993
86.130.9.243:2222
72.134.124.16:443
161.142.103.5:995
80.12.88.148:2222
136.244.25.165:443
92.9.45.20:2222
102.156.77.237:443
98.145.23.67:443
185.69.145.198:443
2.36.64.159:2078
81.101.185.146:443
109.11.175.42:2222
107.146.12.26:2222
201.244.108.183:995
49.175.72.99:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1692 rundll32.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe 1940 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1692 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exewermgr.exedescription pid process target process PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1692 1976 rundll32.exe rundll32.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1692 wrote to memory of 1940 1692 rundll32.exe wermgr.exe PID 1940 wrote to memory of 884 1940 wermgr.exe ping.exe PID 1940 wrote to memory of 884 1940 wermgr.exe ping.exe PID 1940 wrote to memory of 884 1940 wermgr.exe ping.exe PID 1940 wrote to memory of 884 1940 wermgr.exe ping.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\430000.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\430000.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ping.exeping -n 3 yahoo.com4⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1940-54-0x00000000000F0000-0x00000000000F2000-memory.dmpFilesize
8KB
-
memory/1940-55-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-56-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-57-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-58-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-59-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-60-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-61-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB
-
memory/1940-63-0x00000000000C0000-0x00000000000E4000-memory.dmpFilesize
144KB