Analysis
-
max time kernel
1200s -
max time network
1183s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-06-2023 15:31
Static task
static1
Behavioral task
behavioral1
Sample
cropped.dll
Resource
win7-20230220-en
General
-
Target
cropped.dll
-
Size
840KB
-
MD5
1b8277899d678d98cda66bccdcb8a64c
-
SHA1
e401df5cbf16b3500afe39a0199e50359409b731
-
SHA256
6bac623521bd145f87812a0084a3d979f3d8cdec234bc618fd677877b7798839
-
SHA512
f09abd7b89808374c458ca5a89c917db21f9e5270637874008f3bea883a571124d9ea81ec325de1b77bc438a6e94dfa7741fec1642dbd68d5e93edf2235d28c9
-
SSDEEP
12288:ovXYcP7kXn89DhAw1aUN3RFEycMFSDXxqEbHXeL/Lt72G3O0ch:mvTkXnyD6ORDccmEs3M/Lt72G3O0
Malware Config
Extracted
qakbot
404.1346
BB30
1685604052
47.199.241.39:443
93.147.235.8:443
75.141.227.169:443
45.243.142.31:995
79.92.15.6:443
85.104.105.67:443
89.129.109.27:2222
86.176.83.44:2222
24.234.220.88:993
89.32.156.5:995
12.172.173.82:22
103.101.203.177:443
70.28.50.223:2083
98.187.21.2:443
70.49.205.198:2222
96.56.197.26:2222
92.9.45.20:2222
86.195.14.72:2222
172.115.17.50:443
100.4.163.158:2222
80.12.88.148:2222
213.64.33.92:2222
113.11.92.30:443
78.192.109.105:2222
47.34.30.133:443
122.184.143.86:443
198.2.51.242:993
165.120.169.171:2222
88.126.94.4:50000
82.125.44.236:2222
117.195.16.105:993
147.219.4.194:443
80.167.196.79:443
92.154.17.149:2222
184.181.75.148:443
95.45.50.93:2222
84.35.26.14:995
201.143.215.69:443
12.172.173.82:2087
50.68.204.71:443
64.121.161.102:443
2.82.8.80:443
79.77.142.22:2222
12.172.173.82:995
223.166.13.95:995
72.134.124.16:443
213.55.33.103:443
183.87.163.165:443
174.4.89.3:443
27.253.11.10:2222
2.49.63.160:2222
92.186.69.229:2222
69.133.162.35:443
81.111.108.123:443
12.172.173.82:20
188.28.19.84:443
90.29.86.138:2222
70.160.67.203:443
186.64.67.30:443
5.107.153.132:2222
125.63.125.205:2078
2.36.64.159:2078
71.38.155.217:443
205.237.67.69:995
70.64.77.115:443
24.234.220.88:990
96.56.197.26:2083
70.28.50.223:2078
103.123.223.133:443
199.27.66.213:443
83.249.198.100:2222
94.204.202.106:443
77.126.99.230:443
72.205.104.134:443
65.95.141.84:2222
173.88.135.179:443
220.240.164.182:443
96.87.28.170:2222
176.142.207.63:443
12.172.173.82:32101
70.50.83.216:2222
161.142.103.187:995
45.62.70.33:443
24.234.220.88:465
103.141.50.43:995
90.7.72.46:2222
76.178.148.107:2222
116.74.163.130:443
46.246.254.242:995
70.28.50.223:2087
12.172.173.82:465
178.175.187.254:443
27.0.48.233:443
83.110.223.61:443
184.182.66.109:443
70.28.50.223:32100
50.68.204.71:993
70.28.50.223:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
76.170.252.153:995
69.242.31.249:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
81.229.117.95:2222
98.145.23.67:443
98.37.25.99:443
69.160.121.6:61201
12.172.173.82:21
75.109.111.89:443
76.86.31.59:443
80.6.50.34:443
116.120.145.170:995
201.244.108.183:995
58.186.75.42:443
68.203.69.96:443
47.149.134.231:443
Signatures
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 804 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1744 rundll32.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe 1948 wermgr.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
whoami.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeDebugPrivilege 1756 whoami.exe Token: SeRestorePrivilege 1488 msiexec.exe Token: SeTakeOwnershipPrivilege 1488 msiexec.exe Token: SeSecurityPrivilege 1488 msiexec.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
rundll32.exerundll32.exewermgr.exedescription pid process target process PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1744 2000 rundll32.exe rundll32.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1744 wrote to memory of 1948 1744 rundll32.exe wermgr.exe PID 1948 wrote to memory of 804 1948 wermgr.exe ipconfig.exe PID 1948 wrote to memory of 804 1948 wermgr.exe ipconfig.exe PID 1948 wrote to memory of 804 1948 wermgr.exe ipconfig.exe PID 1948 wrote to memory of 804 1948 wermgr.exe ipconfig.exe PID 1948 wrote to memory of 1756 1948 wermgr.exe whoami.exe PID 1948 wrote to memory of 1756 1948 wermgr.exe whoami.exe PID 1948 wrote to memory of 1756 1948 wermgr.exe whoami.exe PID 1948 wrote to memory of 1756 1948 wermgr.exe whoami.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cropped.dll,next1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cropped.dll,next2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:804
-
-
C:\Windows\SysWOW64\whoami.exewhoami /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27