Analysis
- max time kernel
150s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2023, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
amounted.dll
Resource
win7-20230220-en
windows7-x64
General
- Target amounted.dll
- Size 279KB
- Sample230614-pbmdkagg5z
- SHA256 fd586ed89b79241966218b63a4dcef796811cc216947ba35f3ea1d8a238ce4eb
- MD5 ed8f05e36358b304d60d28a8441306d9
- SHA1 b2ca59023d54f6a248064ff36170eec3c1eb9bd6
- SHA512 4feddeaea80eecb41f5787625ef9553bd67ce5ba38f5ff11330679d47085934dfc41bc53f4e904034e375271d23ead341771db1193a404d3ffff7b209699be78
- SSDEEP 6144:+RibgWEZ5Txh9QQU7kVTAHluobjrkMk9P18/79O19VGy:+RSBEZ6k9PC/g1a
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.1374
-
BB32
-
1686735623
-
86.129.138.170:443
-
113.11.92.30:443
-
12.172.173.82:2087
-
72.205.104.134:443
-
84.213.236.225:995
-
92.186.69.229:2222
-
1.221.179.74:443
-
103.141.50.43:995
-
58.162.223.233:443
-
96.242.126.116:2222
-
92.154.17.149:2222
-
75.109.111.89:443
-
125.99.76.102:443
-
80.12.88.148:2222
-
109.149.147.195:2222
-
27.99.32.26:2222
-
70.28.50.223:3389
-
70.28.50.223:32100
-
86.97.96.62:2222
-
66.241.183.99:443
-
74.12.146.45:2222
-
190.199.147.209:2222
-
47.205.25.170:443
-
12.172.173.82:993
-
12.172.173.82:22
-
84.35.26.14:995
-
72.134.124.16:443
-
85.240.173.251:2078
-
50.68.186.195:443
-
65.190.242.244:443
-
45.62.75.217:443
-
203.109.44.236:995
-
174.58.146.57:443
-
105.184.159.9:995
-
94.207.115.105:443
-
197.0.146.211:443
-
197.204.11.218:443
-
92.9.45.20:2222
-
91.169.12.198:32100
-
12.172.173.82:20
-
70.64.77.115:443
-
71.31.9.49:995
-
24.234.220.88:990
-
95.45.50.93:2222
-
213.91.235.146:443
-
189.223.184.79:443
-
213.64.33.92:2222
-
47.34.30.133:443
-
70.28.50.223:2087
-
12.172.173.82:465
-
67.219.197.94:443
-
103.140.174.20:2222
-
12.172.173.82:995
-
90.29.86.138:2222
-
37.14.229.220:2222
-
89.181.227.42:2222
-
62.35.230.21:995
-
70.160.67.203:443
-
88.126.94.4:50000
-
203.219.204.180:443
-
147.219.4.194:443
-
92.20.204.198:2222
-
24.234.220.88:993
-
188.28.19.84:443
-
89.115.200.234:443
-
67.87.119.216:2083
-
86.98.222.20:443
-
161.142.100.114:995
-
103.139.242.6:443
-
103.123.223.153:443
-
24.234.220.88:995
-
102.158.231.164:443
-
175.156.65.126:2222
-
41.227.190.59:443
-
178.175.187.254:443
-
180.151.13.23:2078
-
12.172.173.82:50001
-
116.75.63.143:443
-
74.12.146.45:2083
-
78.192.109.105:2222
-
37.186.55.8:2222
-
121.121.100.202:995
-
104.35.24.154:443
-
199.27.66.213:443
-
181.165.19.254:443
-
81.229.117.95:2222
-
12.172.173.82:21
-
45.2.61.134:3389
-
162.248.14.107:443
-
103.212.19.254:995
-
2.82.8.80:443
-
103.144.201.63:2078
-
114.143.176.237:443
-
103.113.68.33:443
-
77.126.99.230:443
-
47.21.51.138:443
-
197.86.195.10:443
-
36.152.128.5:2222
-
12.172.173.82:32101
-
86.248.228.57:2078
-
92.149.250.113:2222
-
70.28.50.223:1194
-
82.127.153.75:2222
-
78.159.145.7:995
-
82.125.44.236:2222
-
24.234.220.88:465
-
64.121.161.102:443
-
187.199.244.117:32103
-
122.184.143.86:443
-
79.168.224.165:2222
-
65.30.139.145:995
-
151.62.174.154:443
-
124.122.47.148:443
-
31.190.240.11:443
-
92.239.81.124:443
-
31.53.29.210:2222
-
172.115.17.50:443
-
70.28.50.223:2083
-
124.149.143.189:2222
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe 4552 wermgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2680 2616 rundll32.exe 85 PID 2616 wrote to memory of 2680 2616 rundll32.exe 85 PID 2616 wrote to memory of 2680 2616 rundll32.exe 85 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86 PID 2680 wrote to memory of 4552 2680 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\amounted.dll,must1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\amounted.dll,must2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-