Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2023 18:57
Static task
static1
Behavioral task
behavioral1
Sample
41da9355b1137296861187c51515f019cb358ce493136c54a60d1c1d8bf98ed9.dll
Resource
win7-20230220-en
General
-
Target
41da9355b1137296861187c51515f019cb358ce493136c54a60d1c1d8bf98ed9.dll
-
Size
1.1MB
-
MD5
fde3e9bb6886fcf55a2c6e13f87967b8
-
SHA1
706f36fcc8e4c40da57092c0d22ed8d047b3399a
-
SHA256
41da9355b1137296861187c51515f019cb358ce493136c54a60d1c1d8bf98ed9
-
SHA512
3106864317600d3424e18d062d069e60d4d48c3d0a05cd8ee5d4c632d02a07a00ab5236aa68c8bfb978d8cdf6a4ba7193a3044e23edc22dedd3cd18c2d544f09
-
SSDEEP
24576:N/QKBLJ2TutS+yAFHBdfuwufXJFeZahuC9T6r57hoYNtwj:eRgqLMZc9TY57Oetwj
Malware Config
Extracted
qakbot
404.476
BB20
1679552371
86.225.214.138:2222
49.175.72.7:443
99.252.190.205:2222
102.158.63.36:443
92.186.69.229:2222
216.36.153.248:443
72.205.104.134:443
103.140.174.20:2222
98.145.23.67:443
124.246.122.199:2222
223.167.12.241:995
45.50.233.214:443
12.172.173.82:993
95.242.101.251:995
190.199.184.114:2222
2.82.8.80:443
104.35.24.154:443
184.176.35.223:2222
91.2.135.211:995
12.172.173.82:22
178.152.121.81:443
201.244.108.183:995
176.142.207.63:443
182.185.248.125:995
74.66.134.24:443
24.178.201.230:2222
212.70.98.161:2222
67.219.197.94:443
178.175.187.254:443
193.253.100.236:2222
70.53.31.142:2222
76.80.180.154:995
90.104.22.28:2222
24.117.237.157:443
90.55.106.37:2222
71.38.155.217:443
103.252.7.238:443
116.72.250.18:443
76.170.252.153:995
73.36.196.11:443
81.229.117.95:2222
50.68.204.71:995
161.142.103.5:995
35.143.97.145:995
66.131.25.6:443
103.111.70.66:443
103.141.50.102:995
183.82.107.190:443
119.82.123.252:443
83.92.85.93:443
72.53.103.56:443
202.142.98.62:995
202.142.98.62:443
99.253.131.148:443
125.99.69.178:443
12.172.173.82:2087
184.153.132.82:443
49.245.95.124:2222
47.34.30.133:443
98.147.155.235:443
217.165.69.89:2222
175.112.248.228:443
172.115.17.50:443
217.165.246.19:2222
184.176.110.61:61202
217.165.234.168:443
27.0.48.233:443
103.42.86.110:995
64.237.245.195:443
69.119.123.159:2222
174.104.184.149:443
12.172.173.82:465
209.216.123.118:3389
69.133.162.35:443
12.172.173.82:32101
50.68.186.195:443
98.37.25.99:443
109.153.195.56:443
71.65.145.108:443
47.132.248.132:443
86.97.68.68:2222
108.44.207.232:443
122.186.210.254:443
103.111.70.66:995
103.144.201.53:2078
72.200.109.104:443
188.176.171.3:443
72.88.245.71:443
5.192.141.211:2222
67.10.2.240:995
174.4.89.3:443
86.191.9.6:995
47.205.18.103:443
75.90.114.237:995
114.143.176.235:443
182.75.189.42:995
103.113.68.33:443
50.68.204.71:993
162.248.14.107:443
122.184.143.82:443
78.69.251.252:2222
198.2.51.242:993
12.172.173.82:50001
92.159.173.52:2222
50.68.204.71:443
72.134.124.16:443
47.203.229.168:443
12.172.173.82:995
84.216.198.124:6881
70.48.233.117:995
174.21.64.35:2222
75.143.236.149:443
71.171.83.69:443
112.222.83.147:6881
80.42.186.99:2222
213.91.235.146:443
72.203.216.98:2222
136.244.25.165:443
73.165.119.20:443
12.172.173.82:20
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 2004 rundll32.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe 588 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 2004 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 1232 wrote to memory of 2004 1232 rundll32.exe rundll32.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe PID 2004 wrote to memory of 588 2004 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41da9355b1137296861187c51515f019cb358ce493136c54a60d1c1d8bf98ed9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41da9355b1137296861187c51515f019cb358ce493136c54a60d1c1d8bf98ed9.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-63-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-57-0x0000000000100000-0x0000000000102000-memory.dmpFilesize
8KB
-
memory/588-59-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-61-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-62-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-64-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-65-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/588-67-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/2004-55-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/2004-56-0x0000000000870000-0x00000000008A5000-memory.dmpFilesize
212KB
-
memory/2004-58-0x0000000000870000-0x00000000008A5000-memory.dmpFilesize
212KB
-
memory/2004-60-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/2004-54-0x0000000000870000-0x00000000008A5000-memory.dmpFilesize
212KB