Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 19:35
Static task
static1
Behavioral task
behavioral1
Sample
979e30ec1e402ede4b222830f8f61818b3811acbbc670cf7b8790b2a70444cd0.dll
Resource
win7-20230220-en
General
-
Target
979e30ec1e402ede4b222830f8f61818b3811acbbc670cf7b8790b2a70444cd0.dll
-
Size
540KB
-
MD5
f361269dae9fe04123fcf35a99a627fb
-
SHA1
4b93e061f777368fd71eb979bfc3358a07e7d814
-
SHA256
979e30ec1e402ede4b222830f8f61818b3811acbbc670cf7b8790b2a70444cd0
-
SHA512
90930e541617687e4faa2e48f3f9eb6e99b35caad0948e3c2ff2e825557b3efe83e6521d4cd841f8852017b1768c2e7e64431efcaa5cf2d3067109d298188c49
-
SSDEEP
6144:X4dlVBTQZZ8G0rGyIENIFcmiNt19wJ+rD4bLU/GOMjaoz9VnRVt6YZNS6IO0pD1h:X4dp5GxGIID9sUHkaYhoYZNtIH3i2
Malware Config
Extracted
qakbot
404.476
BB20
1679552371
86.225.214.138:2222
49.175.72.7:443
99.252.190.205:2222
102.158.63.36:443
92.186.69.229:2222
216.36.153.248:443
72.205.104.134:443
103.140.174.20:2222
98.145.23.67:443
124.246.122.199:2222
223.167.12.241:995
45.50.233.214:443
12.172.173.82:993
95.242.101.251:995
190.199.184.114:2222
2.82.8.80:443
104.35.24.154:443
184.176.35.223:2222
91.2.135.211:995
12.172.173.82:22
178.152.121.81:443
201.244.108.183:995
176.142.207.63:443
182.185.248.125:995
74.66.134.24:443
24.178.201.230:2222
212.70.98.161:2222
67.219.197.94:443
178.175.187.254:443
193.253.100.236:2222
70.53.31.142:2222
76.80.180.154:995
90.104.22.28:2222
24.117.237.157:443
90.55.106.37:2222
71.38.155.217:443
103.252.7.238:443
116.72.250.18:443
76.170.252.153:995
73.36.196.11:443
81.229.117.95:2222
50.68.204.71:995
161.142.103.5:995
35.143.97.145:995
66.131.25.6:443
103.111.70.66:443
103.141.50.102:995
183.82.107.190:443
119.82.123.252:443
83.92.85.93:443
72.53.103.56:443
202.142.98.62:995
202.142.98.62:443
99.253.131.148:443
125.99.69.178:443
12.172.173.82:2087
184.153.132.82:443
49.245.95.124:2222
47.34.30.133:443
98.147.155.235:443
217.165.69.89:2222
175.112.248.228:443
172.115.17.50:443
217.165.246.19:2222
184.176.110.61:61202
217.165.234.168:443
27.0.48.233:443
103.42.86.110:995
64.237.245.195:443
69.119.123.159:2222
174.104.184.149:443
12.172.173.82:465
209.216.123.118:3389
69.133.162.35:443
12.172.173.82:32101
50.68.186.195:443
98.37.25.99:443
109.153.195.56:443
71.65.145.108:443
47.132.248.132:443
86.97.68.68:2222
108.44.207.232:443
122.186.210.254:443
103.111.70.66:995
103.144.201.53:2078
72.200.109.104:443
188.176.171.3:443
72.88.245.71:443
5.192.141.211:2222
67.10.2.240:995
174.4.89.3:443
86.191.9.6:995
47.205.18.103:443
75.90.114.237:995
114.143.176.235:443
182.75.189.42:995
103.113.68.33:443
50.68.204.71:993
162.248.14.107:443
122.184.143.82:443
78.69.251.252:2222
198.2.51.242:993
12.172.173.82:50001
92.159.173.52:2222
50.68.204.71:443
72.134.124.16:443
47.203.229.168:443
12.172.173.82:995
84.216.198.124:6881
70.48.233.117:995
174.21.64.35:2222
75.143.236.149:443
71.171.83.69:443
112.222.83.147:6881
80.42.186.99:2222
213.91.235.146:443
72.203.216.98:2222
136.244.25.165:443
73.165.119.20:443
12.172.173.82:20
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 3536 rundll32.exe 3536 rundll32.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe 4876 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 3536 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 4320 wrote to memory of 3536 4320 rundll32.exe rundll32.exe PID 4320 wrote to memory of 3536 4320 rundll32.exe rundll32.exe PID 4320 wrote to memory of 3536 4320 rundll32.exe rundll32.exe PID 3536 wrote to memory of 4876 3536 rundll32.exe wermgr.exe PID 3536 wrote to memory of 4876 3536 rundll32.exe wermgr.exe PID 3536 wrote to memory of 4876 3536 rundll32.exe wermgr.exe PID 3536 wrote to memory of 4876 3536 rundll32.exe wermgr.exe PID 3536 wrote to memory of 4876 3536 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\979e30ec1e402ede4b222830f8f61818b3811acbbc670cf7b8790b2a70444cd0.dll, GL701⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\979e30ec1e402ede4b222830f8f61818b3811acbbc670cf7b8790b2a70444cd0.dll, GL702⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3536-133-0x00000000008E0000-0x0000000000969000-memory.dmpFilesize
548KB
-
memory/3536-134-0x0000000002140000-0x0000000002175000-memory.dmpFilesize
212KB
-
memory/3536-135-0x0000000002140000-0x0000000002175000-memory.dmpFilesize
212KB
-
memory/3536-136-0x0000000002140000-0x0000000002175000-memory.dmpFilesize
212KB
-
memory/4876-137-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-138-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-139-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-140-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-141-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-143-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB
-
memory/4876-145-0x0000000000EA0000-0x0000000000ED5000-memory.dmpFilesize
212KB