Analysis
- max time kernel
149s - max time network
33s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
14/06/2023, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
loader/2.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
loader/2.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
loader/loader.bat
Resource
win7-20230220-en
windows7-x64
General
- Target loader/loader.bat
- Size 39B
- Sample230614-sw8dbaaf97
- SHA256 fa37a54bd96fe0ddc92ebe1f5a91755c98e11437d64d1115bb5210291d89f80f
- MD5 9edca2703468373512c0bbe649409319
- SHA1 f4ea07eadb35e32d9c0b88e4641cef4b1c61caa0
- SHA512 c741ede89cce4ed0cf5d51ec713fde4021da109c34e3571c973a4a9e6eb3c8f43dc8a542cb16205bde0f55ab4f79ef0d9b74b324ea3a19e696d7f1a26f11b2d3
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
404.1374
-
BB32
-
1686735623
-
86.129.138.170:443
-
113.11.92.30:443
-
12.172.173.82:2087
-
72.205.104.134:443
-
84.213.236.225:995
-
92.186.69.229:2222
-
1.221.179.74:443
-
103.141.50.43:995
-
58.162.223.233:443
-
96.242.126.116:2222
-
92.154.17.149:2222
-
75.109.111.89:443
-
125.99.76.102:443
-
80.12.88.148:2222
-
109.149.147.195:2222
-
27.99.32.26:2222
-
70.28.50.223:3389
-
70.28.50.223:32100
-
86.97.96.62:2222
-
66.241.183.99:443
-
74.12.146.45:2222
-
190.199.147.209:2222
-
47.205.25.170:443
-
12.172.173.82:993
-
12.172.173.82:22
-
84.35.26.14:995
-
72.134.124.16:443
-
85.240.173.251:2078
-
50.68.186.195:443
-
65.190.242.244:443
-
45.62.75.217:443
-
203.109.44.236:995
-
174.58.146.57:443
-
105.184.159.9:995
-
94.207.115.105:443
-
197.0.146.211:443
-
197.204.11.218:443
-
92.9.45.20:2222
-
91.169.12.198:32100
-
12.172.173.82:20
-
70.64.77.115:443
-
71.31.9.49:995
-
24.234.220.88:990
-
95.45.50.93:2222
-
213.91.235.146:443
-
189.223.184.79:443
-
213.64.33.92:2222
-
47.34.30.133:443
-
70.28.50.223:2087
-
12.172.173.82:465
-
67.219.197.94:443
-
103.140.174.20:2222
-
12.172.173.82:995
-
90.29.86.138:2222
-
37.14.229.220:2222
-
89.181.227.42:2222
-
62.35.230.21:995
-
70.160.67.203:443
-
88.126.94.4:50000
-
203.219.204.180:443
-
147.219.4.194:443
-
92.20.204.198:2222
-
24.234.220.88:993
-
188.28.19.84:443
-
89.115.200.234:443
-
67.87.119.216:2083
-
86.98.222.20:443
-
161.142.100.114:995
-
103.139.242.6:443
-
103.123.223.153:443
-
24.234.220.88:995
-
102.158.231.164:443
-
175.156.65.126:2222
-
41.227.190.59:443
-
178.175.187.254:443
-
180.151.13.23:2078
-
12.172.173.82:50001
-
116.75.63.143:443
-
74.12.146.45:2083
-
78.192.109.105:2222
-
37.186.55.8:2222
-
121.121.100.202:995
-
104.35.24.154:443
-
199.27.66.213:443
-
181.165.19.254:443
-
81.229.117.95:2222
-
12.172.173.82:21
-
45.2.61.134:3389
-
162.248.14.107:443
-
103.212.19.254:995
-
2.82.8.80:443
-
103.144.201.63:2078
-
114.143.176.237:443
-
103.113.68.33:443
-
77.126.99.230:443
-
47.21.51.138:443
-
197.86.195.10:443
-
36.152.128.5:2222
-
12.172.173.82:32101
-
86.248.228.57:2078
-
92.149.250.113:2222
-
70.28.50.223:1194
-
82.127.153.75:2222
-
78.159.145.7:995
-
82.125.44.236:2222
-
24.234.220.88:465
-
64.121.161.102:443
-
187.199.244.117:32103
-
122.184.143.86:443
-
79.168.224.165:2222
-
65.30.139.145:995
-
151.62.174.154:443
-
124.122.47.148:443
-
31.190.240.11:443
-
92.239.81.124:443
-
31.53.29.210:2222
-
172.115.17.50:443
-
70.28.50.223:2083
-
124.149.143.189:2222
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1444 rundll32.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe 676 wermgr.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1036 1264 cmd.exe 28 PID 1264 wrote to memory of 1036 1264 cmd.exe 28 PID 1264 wrote to memory of 1036 1264 cmd.exe 28 PID 1036 wrote to memory of 268 1036 cmd.exe 29 PID 1036 wrote to memory of 268 1036 cmd.exe 29 PID 1036 wrote to memory of 268 1036 cmd.exe 29 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 268 wrote to memory of 1444 268 rundll32.exe 30 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31 PID 1444 wrote to memory of 676 1444 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\loader\loader.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\cmd.execmd /c rundll32 .\2.dll,must2⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\system32\rundll32.exerundll32 .\2.dll,must3⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\rundll32.exerundll32 .\2.dll,must4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:676
-
-
-
-