Analysis
- max time kernel
79s - max time network
82s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2023, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
ignite.dll
Resource
win7-20230220-en
windows7-x64
General
- Target ignite.dll
- Size 823KB
- Sample230601-vd2h6afd77
- SHA256 306cfafd2873823a7faaae77e049ec4fc00ad7e9e98758e0ec1287cc555c5c4a
- MD5 b139ac1ef26db8e8445b4365d71ff8f8
- SHA1 f39b1625df6920c8f111889f385a11d0b34cf895
- SHA512 9b489a7a67c328796df1c3f71b22b30b1b6832b644c30bd588e41745ce55923e1991ba51e88ddcfb7e59bba37571388cf2f5ec95159c4e486d6201abe0560478
- SSDEEP 12288:ovXYcP7kXn89DhAw1aUN3RFEycMFSDXxqEbHXeL/Lt72G3+0ch:mvTkXnyD6ORDccmEs3M/Lt72G3+0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.1346
-
BB30
-
1685604052
-
47.199.241.39:443
-
93.147.235.8:443
-
75.141.227.169:443
-
45.243.142.31:995
-
79.92.15.6:443
-
85.104.105.67:443
-
89.129.109.27:2222
-
86.176.83.44:2222
-
24.234.220.88:993
-
89.32.156.5:995
-
12.172.173.82:22
-
103.101.203.177:443
-
70.28.50.223:2083
-
98.187.21.2:443
-
70.49.205.198:2222
-
96.56.197.26:2222
-
92.9.45.20:2222
-
86.195.14.72:2222
-
172.115.17.50:443
-
100.4.163.158:2222
-
80.12.88.148:2222
-
213.64.33.92:2222
-
113.11.92.30:443
-
78.192.109.105:2222
-
47.34.30.133:443
-
122.184.143.86:443
-
198.2.51.242:993
-
165.120.169.171:2222
-
88.126.94.4:50000
-
82.125.44.236:2222
-
117.195.16.105:993
-
147.219.4.194:443
-
80.167.196.79:443
-
92.154.17.149:2222
-
184.181.75.148:443
-
95.45.50.93:2222
-
84.35.26.14:995
-
201.143.215.69:443
-
12.172.173.82:2087
-
50.68.204.71:443
-
64.121.161.102:443
-
2.82.8.80:443
-
79.77.142.22:2222
-
12.172.173.82:995
-
223.166.13.95:995
-
72.134.124.16:443
-
213.55.33.103:443
-
183.87.163.165:443
-
174.4.89.3:443
-
27.253.11.10:2222
-
2.49.63.160:2222
-
92.186.69.229:2222
-
69.133.162.35:443
-
81.111.108.123:443
-
12.172.173.82:20
-
188.28.19.84:443
-
90.29.86.138:2222
-
70.160.67.203:443
-
186.64.67.30:443
-
5.107.153.132:2222
-
125.63.125.205:2078
-
2.36.64.159:2078
-
71.38.155.217:443
-
205.237.67.69:995
-
70.64.77.115:443
-
24.234.220.88:990
-
96.56.197.26:2083
-
70.28.50.223:2078
-
103.123.223.133:443
-
199.27.66.213:443
-
83.249.198.100:2222
-
94.204.202.106:443
-
77.126.99.230:443
-
72.205.104.134:443
-
65.95.141.84:2222
-
173.88.135.179:443
-
220.240.164.182:443
-
96.87.28.170:2222
-
176.142.207.63:443
-
12.172.173.82:32101
-
70.50.83.216:2222
-
161.142.103.187:995
-
45.62.70.33:443
-
24.234.220.88:465
-
103.141.50.43:995
-
90.7.72.46:2222
-
76.178.148.107:2222
-
116.74.163.130:443
-
46.246.254.242:995
-
70.28.50.223:2087
-
12.172.173.82:465
-
178.175.187.254:443
-
27.0.48.233:443
-
83.110.223.61:443
-
184.182.66.109:443
-
70.28.50.223:32100
-
50.68.204.71:993
-
70.28.50.223:3389
-
50.68.186.195:443
-
47.205.25.170:443
-
12.172.173.82:993
-
76.170.252.153:995
-
69.242.31.249:443
-
79.168.224.165:2222
-
75.143.236.149:443
-
14.192.241.76:995
-
81.229.117.95:2222
-
98.145.23.67:443
-
98.37.25.99:443
-
69.160.121.6:61201
-
12.172.173.82:21
-
75.109.111.89:443
-
76.86.31.59:443
-
80.6.50.34:443
-
116.120.145.170:995
-
201.244.108.183:995
-
58.186.75.42:443
-
68.203.69.96:443
-
47.149.134.231:443
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 rundll32.exe 5028 rundll32.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe 4952 wermgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 948 wrote to memory of 5028 948 rundll32.exe 84 PID 948 wrote to memory of 5028 948 rundll32.exe 84 PID 948 wrote to memory of 5028 948 rundll32.exe 84 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85 PID 5028 wrote to memory of 4952 5028 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ignite.dll,next1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ignite.dll,next2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
-