Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
b0r1sCantMakeUphisMind.dll
Resource
win7-20230220-en
General
-
Target
b0r1sCantMakeUphisMind.dll
-
Size
977KB
-
MD5
57a01187097a9f0bc4bbb77a50f9d9f8
-
SHA1
576463418b6813334b58a0dc19c2aa05bc3cea91
-
SHA256
7783fb922abee77ebc12618187fe164cf8beecbedf4e8e91ad08434ccacc929b
-
SHA512
6a7d740e0da849b8ab720e097cc5052ab12af47b2e79687e22edf8cae2115d6bfc9078d9fc4ccc4efe6e8c9703783ae8420ed49a5476f72dbdb3c1173c801bd8
-
SSDEEP
12288:dIAETyZizswDZr2rnVed8b2NFCKh6RaG7EeDATbURJTdL7K2Lzla:dI3AwDj02Nlh6IG7EeYU7TVW2Lzla
Malware Config
Extracted
qakbot
404.981
BB24
1681731194
198.2.51.242:993
87.221.196.82:2222
27.109.19.90:2078
125.99.69.178:443
84.216.198.124:6881
82.131.135.172:443
82.11.242.219:443
41.228.47.155:995
114.143.176.235:443
47.21.51.138:443
109.146.76.176:2222
174.4.89.3:443
12.172.173.82:32101
92.27.86.48:2222
79.77.142.22:2222
64.121.161.102:443
70.28.50.223:1194
72.205.104.134:443
49.245.95.124:2222
197.2.225.108:443
213.91.235.146:443
75.115.14.189:443
70.28.50.223:3389
70.28.50.223:2087
81.229.117.95:2222
72.134.124.16:443
76.170.252.153:995
41.227.217.128:443
173.88.135.179:443
75.149.21.157:443
95.60.243.102:995
35.143.97.145:995
50.68.186.195:443
213.67.139.53:2222
91.169.12.198:32100
50.68.204.71:993
78.192.109.105:2222
75.143.236.149:443
98.145.23.67:443
50.68.204.71:443
69.133.162.35:443
67.253.226.137:995
70.28.50.223:2078
157.119.85.203:443
103.144.201.56:2078
12.172.173.82:993
70.28.50.223:2083
92.186.69.229:2222
41.186.88.38:443
86.236.114.212:2222
151.62.97.204:443
124.149.143.189:2222
93.238.52.211:995
94.63.65.146:443
92.239.81.124:443
24.206.27.39:443
2.237.150.131:2222
24.150.188.234:443
41.99.49.138:443
92.9.45.20:2222
68.14.195.55:995
91.35.212.133:995
89.129.109.27:2222
70.160.80.210:443
12.172.173.82:20
70.112.206.5:443
80.12.88.148:2222
151.237.76.117:443
88.126.94.4:50000
37.14.229.220:2222
78.193.176.97:443
81.156.1.223:443
90.104.151.37:2222
90.55.106.37:2222
77.126.185.173:443
202.186.177.220:443
93.150.183.229:2222
12.172.173.82:22
74.92.243.115:50000
75.109.111.89:443
103.123.223.141:443
136.232.184.134:995
183.87.163.165:443
201.244.108.183:995
172.90.139.138:2222
91.231.173.14:995
47.205.25.170:443
71.171.83.69:443
71.38.155.217:443
209.93.207.224:2222
14.192.241.76:995
12.172.173.82:2087
92.154.17.149:2222
37.189.1.102:443
12.172.173.82:50001
176.202.45.209:443
72.203.216.98:2222
118.249.191.32:995
27.99.32.26:2222
178.175.187.254:443
108.32.72.145:443
2.82.8.80:443
86.178.33.125:2222
68.173.170.110:8443
186.64.67.32:443
82.36.36.76:443
12.172.173.82:995
92.189.214.236:2222
86.225.214.138:2222
86.154.216.221:2222
68.229.150.95:443
102.156.177.209:443
96.87.28.170:2222
202.142.98.62:443
92.136.62.50:2222
175.156.65.126:2222
125.99.76.102:443
92.20.204.198:2222
91.165.188.74:50000
45.243.231.146:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3840 ping.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4168 rundll32.exe 4168 rundll32.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe 1420 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4168 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1784 wrote to memory of 4168 1784 rundll32.exe 83 PID 1784 wrote to memory of 4168 1784 rundll32.exe 83 PID 1784 wrote to memory of 4168 1784 rundll32.exe 83 PID 4168 wrote to memory of 1420 4168 rundll32.exe 84 PID 4168 wrote to memory of 1420 4168 rundll32.exe 84 PID 4168 wrote to memory of 1420 4168 rundll32.exe 84 PID 4168 wrote to memory of 1420 4168 rundll32.exe 84 PID 4168 wrote to memory of 1420 4168 rundll32.exe 84 PID 1420 wrote to memory of 3840 1420 wermgr.exe 85 PID 1420 wrote to memory of 3840 1420 wermgr.exe 85 PID 1420 wrote to memory of 3840 1420 wermgr.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,Motd1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,Motd2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\ping.exeping -n 3 yahoo.com4⤵
- Runs ping.exe
PID:3840
-
-
-