Analysis
-
max time kernel
151s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-04-2023 15:38
Static task
static1
Behavioral task
behavioral1
Sample
5bbb237c3a5bd16dd35889fe6b7dac5ef3315f517c0fbd5328b41be0799a3b60.dll
Resource
win7-20230220-en
General
-
Target
5bbb237c3a5bd16dd35889fe6b7dac5ef3315f517c0fbd5328b41be0799a3b60.dll
-
Size
580KB
-
MD5
aef019590c6b18467b52d8566da497d4
-
SHA1
e73b1f459cb640c1f5ccba5553662341ac57bf9f
-
SHA256
5bbb237c3a5bd16dd35889fe6b7dac5ef3315f517c0fbd5328b41be0799a3b60
-
SHA512
ae5336510b2d6cb409da73a97610663d596ddb1bc8a47eac13e0f0088face4a7b37c58bbf4c37bb304bce3dfc8f6b4d647aa872fba6248f3ee8b4e5d7f6c2dd9
-
SSDEEP
6144:k/ZzllHDjygb7kZJUP9SDTOq3WlrQQurP/o2SiN5ryK9T+gZw/NCxeczYjlDtKK8:+HDjygXeIBrbYXPCd/NyYxRGu5DO
Malware Config
Extracted
qakbot
404.909
BB22
1680688614
209.93.207.224:2222
90.93.132.149:2222
109.11.175.42:2222
12.172.173.82:993
86.195.14.72:2222
82.121.195.187:2222
88.122.133.88:32100
86.154.216.221:2222
91.82.133.190:443
197.3.198.241:443
70.112.206.5:443
12.172.173.82:50001
103.123.223.141:443
103.141.50.102:995
201.244.108.183:995
183.87.163.165:443
76.178.148.107:2222
96.87.28.170:2222
76.80.180.154:993
92.189.214.236:2222
95.60.243.64:995
80.12.88.148:2222
86.225.214.138:2222
90.165.109.4:2222
88.126.94.4:50000
104.35.24.154:443
147.219.4.194:443
105.102.30.255:443
139.226.47.229:995
71.171.83.69:443
45.50.233.214:443
92.154.17.149:2222
59.153.96.4:443
75.109.111.89:443
125.99.76.102:443
47.205.25.170:443
12.172.173.82:995
102.158.82.17:443
92.20.199.185:2222
24.236.90.196:2078
116.74.164.148:443
37.14.229.220:2222
98.37.25.99:443
43.243.215.206:443
84.35.26.14:995
116.72.250.18:443
190.78.69.250:2222
12.172.173.82:2087
90.55.106.37:2222
119.82.123.160:443
202.142.98.62:443
202.142.98.62:995
93.24.192.142:20
27.109.19.90:2078
136.244.25.165:443
50.68.204.71:995
109.50.143.218:2222
12.172.173.82:465
2.237.150.131:2222
77.126.11.114:443
50.68.204.71:443
81.229.117.95:2222
184.153.132.82:443
12.172.173.82:21
73.36.196.11:443
103.87.128.228:443
213.67.139.53:2222
92.186.69.229:2222
172.115.17.50:443
86.98.23.66:443
75.98.154.19:443
69.133.162.35:443
178.175.187.254:443
47.21.51.138:443
109.159.118.65:2222
12.172.173.82:32101
49.245.95.124:2222
89.129.109.27:2222
41.227.217.128:443
85.241.180.94:443
35.143.97.145:995
2.82.8.80:443
83.92.85.93:443
47.34.30.133:443
71.38.155.217:443
50.68.204.71:993
92.1.170.110:995
12.172.173.82:22
76.170.252.153:995
80.13.205.69:2222
50.68.186.195:443
213.91.235.146:443
186.64.87.204:443
174.4.89.3:443
75.143.236.149:443
103.113.68.33:443
198.2.51.242:993
82.122.128.149:2222
71.31.232.65:995
81.150.42.123:443
83.213.192.136:443
59.28.84.65:443
41.96.194.114:443
72.200.109.104:443
122.186.210.254:443
103.144.201.53:2078
90.211.192.113:443
92.97.115.255:2222
112.222.83.147:6881
105.225.50.146:995
103.42.86.42:995
87.243.146.59:443
47.199.241.39:443
12.172.173.82:20
162.248.14.107:443
71.31.100.192:443
84.155.13.118:995
67.10.2.240:995
176.142.207.63:443
70.160.80.210:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1740 rundll32.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe 1160 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1740 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exewermgr.exedescription pid process target process PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1496 wrote to memory of 1740 1496 rundll32.exe rundll32.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1740 wrote to memory of 1160 1740 rundll32.exe wermgr.exe PID 1160 wrote to memory of 1760 1160 wermgr.exe ping.exe PID 1160 wrote to memory of 1760 1160 wermgr.exe ping.exe PID 1160 wrote to memory of 1760 1160 wermgr.exe ping.exe PID 1160 wrote to memory of 1760 1160 wermgr.exe ping.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bbb237c3a5bd16dd35889fe6b7dac5ef3315f517c0fbd5328b41be0799a3b60.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bbb237c3a5bd16dd35889fe6b7dac5ef3315f517c0fbd5328b41be0799a3b60.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ping.exeping -n 3 yahoo.com4⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-64-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1160-75-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-73-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-72-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-71-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-70-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-68-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-66-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1160-65-0x0000000000080000-0x00000000000A4000-memory.dmpFilesize
144KB
-
memory/1740-62-0x0000000001D50000-0x0000000001DE3000-memory.dmpFilesize
588KB
-
memory/1740-54-0x0000000001D50000-0x0000000001DE3000-memory.dmpFilesize
588KB
-
memory/1740-61-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-67-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-60-0x00000000002B0000-0x00000000002D6000-memory.dmpFilesize
152KB
-
memory/1740-59-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-58-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-57-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-56-0x0000000000810000-0x0000000000834000-memory.dmpFilesize
144KB
-
memory/1740-55-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB