Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2023, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
B247.dll
Resource
win7-20230220-en
windows7-x64
General
- Target B247.dll
- Size 844KB
- Sample230601-2jhfssgg76
- SHA256 8bc0c9ff5e184b47a44d5967bfd766078da779a1f046b31c3de6d6ee0e3a9f9f
- MD5 8fb4381852ec12e6c198f1b0d908fb98
- SHA1 ca9fd5befa0347c9e403166260d2bbf99b5c7e35
- SHA512 7adb12cf5dbf1c5b2d6a4f583212f1bebfbe2c6fb39fbea6f629b303642c12e2cef7dec0613e2d62001fe937b2bad9797b4faed6ef90e779452417e2a272caed
- SSDEEP 12288:ovXYcP7kXn89DhAw1aUN3RFEycMFSDXxqEbHXeL/Lt72G310ch:mvTkXnyD6ORDccmEs3M/Lt72G310
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.1346
-
BB30
-
1685604052
-
47.199.241.39:443
-
93.147.235.8:443
-
75.141.227.169:443
-
45.243.142.31:995
-
79.92.15.6:443
-
85.104.105.67:443
-
89.129.109.27:2222
-
86.176.83.44:2222
-
24.234.220.88:993
-
89.32.156.5:995
-
12.172.173.82:22
-
103.101.203.177:443
-
70.28.50.223:2083
-
98.187.21.2:443
-
70.49.205.198:2222
-
96.56.197.26:2222
-
92.9.45.20:2222
-
86.195.14.72:2222
-
172.115.17.50:443
-
100.4.163.158:2222
-
80.12.88.148:2222
-
213.64.33.92:2222
-
113.11.92.30:443
-
78.192.109.105:2222
-
47.34.30.133:443
-
122.184.143.86:443
-
198.2.51.242:993
-
165.120.169.171:2222
-
88.126.94.4:50000
-
82.125.44.236:2222
-
117.195.16.105:993
-
147.219.4.194:443
-
80.167.196.79:443
-
92.154.17.149:2222
-
184.181.75.148:443
-
95.45.50.93:2222
-
84.35.26.14:995
-
201.143.215.69:443
-
12.172.173.82:2087
-
50.68.204.71:443
-
64.121.161.102:443
-
2.82.8.80:443
-
79.77.142.22:2222
-
12.172.173.82:995
-
223.166.13.95:995
-
72.134.124.16:443
-
213.55.33.103:443
-
183.87.163.165:443
-
174.4.89.3:443
-
27.253.11.10:2222
-
2.49.63.160:2222
-
92.186.69.229:2222
-
69.133.162.35:443
-
81.111.108.123:443
-
12.172.173.82:20
-
188.28.19.84:443
-
90.29.86.138:2222
-
70.160.67.203:443
-
186.64.67.30:443
-
5.107.153.132:2222
-
125.63.125.205:2078
-
2.36.64.159:2078
-
71.38.155.217:443
-
205.237.67.69:995
-
70.64.77.115:443
-
24.234.220.88:990
-
96.56.197.26:2083
-
70.28.50.223:2078
-
103.123.223.133:443
-
199.27.66.213:443
-
83.249.198.100:2222
-
94.204.202.106:443
-
77.126.99.230:443
-
72.205.104.134:443
-
65.95.141.84:2222
-
173.88.135.179:443
-
220.240.164.182:443
-
96.87.28.170:2222
-
176.142.207.63:443
-
12.172.173.82:32101
-
70.50.83.216:2222
-
161.142.103.187:995
-
45.62.70.33:443
-
24.234.220.88:465
-
103.141.50.43:995
-
90.7.72.46:2222
-
76.178.148.107:2222
-
116.74.163.130:443
-
46.246.254.242:995
-
70.28.50.223:2087
-
12.172.173.82:465
-
178.175.187.254:443
-
27.0.48.233:443
-
83.110.223.61:443
-
184.182.66.109:443
-
70.28.50.223:32100
-
50.68.204.71:993
-
70.28.50.223:3389
-
50.68.186.195:443
-
47.205.25.170:443
-
12.172.173.82:993
-
76.170.252.153:995
-
69.242.31.249:443
-
79.168.224.165:2222
-
75.143.236.149:443
-
14.192.241.76:995
-
81.229.117.95:2222
-
98.145.23.67:443
-
98.37.25.99:443
-
69.160.121.6:61201
-
12.172.173.82:21
-
75.109.111.89:443
-
76.86.31.59:443
-
80.6.50.34:443
-
116.120.145.170:995
-
201.244.108.183:995
-
58.186.75.42:443
-
68.203.69.96:443
-
47.149.134.231:443
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 rundll32.exe 1328 rundll32.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe 1664 wermgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 384 wrote to memory of 1328 384 rundll32.exe 84 PID 384 wrote to memory of 1328 384 rundll32.exe 84 PID 384 wrote to memory of 1328 384 rundll32.exe 84 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85 PID 1328 wrote to memory of 1664 1328 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\B247.dll, next1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\B247.dll, next2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-