Analysis
- max time kernel
149s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2023, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
loader/2.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
loader/2.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
loader/loader.bat
Resource
win7-20230220-en
windows7-x64
General
- Target loader/loader.bat
- Size 39B
- Sample230614-sw8dbaaf97
- SHA256 fa37a54bd96fe0ddc92ebe1f5a91755c98e11437d64d1115bb5210291d89f80f
- MD5 9edca2703468373512c0bbe649409319
- SHA1 f4ea07eadb35e32d9c0b88e4641cef4b1c61caa0
- SHA512 c741ede89cce4ed0cf5d51ec713fde4021da109c34e3571c973a4a9e6eb3c8f43dc8a542cb16205bde0f55ab4f79ef0d9b74b324ea3a19e696d7f1a26f11b2d3
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
404.1374
-
BB32
-
1686735623
-
86.129.138.170:443
-
113.11.92.30:443
-
12.172.173.82:2087
-
72.205.104.134:443
-
84.213.236.225:995
-
92.186.69.229:2222
-
1.221.179.74:443
-
103.141.50.43:995
-
58.162.223.233:443
-
96.242.126.116:2222
-
92.154.17.149:2222
-
75.109.111.89:443
-
125.99.76.102:443
-
80.12.88.148:2222
-
109.149.147.195:2222
-
27.99.32.26:2222
-
70.28.50.223:3389
-
70.28.50.223:32100
-
86.97.96.62:2222
-
66.241.183.99:443
-
74.12.146.45:2222
-
190.199.147.209:2222
-
47.205.25.170:443
-
12.172.173.82:993
-
12.172.173.82:22
-
84.35.26.14:995
-
72.134.124.16:443
-
85.240.173.251:2078
-
50.68.186.195:443
-
65.190.242.244:443
-
45.62.75.217:443
-
203.109.44.236:995
-
174.58.146.57:443
-
105.184.159.9:995
-
94.207.115.105:443
-
197.0.146.211:443
-
197.204.11.218:443
-
92.9.45.20:2222
-
91.169.12.198:32100
-
12.172.173.82:20
-
70.64.77.115:443
-
71.31.9.49:995
-
24.234.220.88:990
-
95.45.50.93:2222
-
213.91.235.146:443
-
189.223.184.79:443
-
213.64.33.92:2222
-
47.34.30.133:443
-
70.28.50.223:2087
-
12.172.173.82:465
-
67.219.197.94:443
-
103.140.174.20:2222
-
12.172.173.82:995
-
90.29.86.138:2222
-
37.14.229.220:2222
-
89.181.227.42:2222
-
62.35.230.21:995
-
70.160.67.203:443
-
88.126.94.4:50000
-
203.219.204.180:443
-
147.219.4.194:443
-
92.20.204.198:2222
-
24.234.220.88:993
-
188.28.19.84:443
-
89.115.200.234:443
-
67.87.119.216:2083
-
86.98.222.20:443
-
161.142.100.114:995
-
103.139.242.6:443
-
103.123.223.153:443
-
24.234.220.88:995
-
102.158.231.164:443
-
175.156.65.126:2222
-
41.227.190.59:443
-
178.175.187.254:443
-
180.151.13.23:2078
-
12.172.173.82:50001
-
116.75.63.143:443
-
74.12.146.45:2083
-
78.192.109.105:2222
-
37.186.55.8:2222
-
121.121.100.202:995
-
104.35.24.154:443
-
199.27.66.213:443
-
181.165.19.254:443
-
81.229.117.95:2222
-
12.172.173.82:21
-
45.2.61.134:3389
-
162.248.14.107:443
-
103.212.19.254:995
-
2.82.8.80:443
-
103.144.201.63:2078
-
114.143.176.237:443
-
103.113.68.33:443
-
77.126.99.230:443
-
47.21.51.138:443
-
197.86.195.10:443
-
36.152.128.5:2222
-
12.172.173.82:32101
-
86.248.228.57:2078
-
92.149.250.113:2222
-
70.28.50.223:1194
-
82.127.153.75:2222
-
78.159.145.7:995
-
82.125.44.236:2222
-
24.234.220.88:465
-
64.121.161.102:443
-
187.199.244.117:32103
-
122.184.143.86:443
-
79.168.224.165:2222
-
65.30.139.145:995
-
151.62.174.154:443
-
124.122.47.148:443
-
31.190.240.11:443
-
92.239.81.124:443
-
31.53.29.210:2222
-
172.115.17.50:443
-
70.28.50.223:2083
-
124.149.143.189:2222
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 rundll32.exe 2112 rundll32.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe 3756 wermgr.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3752 wrote to memory of 4928 3752 cmd.exe 80 PID 3752 wrote to memory of 4928 3752 cmd.exe 80 PID 4928 wrote to memory of 4580 4928 cmd.exe 81 PID 4928 wrote to memory of 4580 4928 cmd.exe 81 PID 4580 wrote to memory of 2112 4580 rundll32.exe 82 PID 4580 wrote to memory of 2112 4580 rundll32.exe 82 PID 4580 wrote to memory of 2112 4580 rundll32.exe 82 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83 PID 2112 wrote to memory of 3756 2112 rundll32.exe 83
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\loader\loader.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\system32\cmd.execmd /c rundll32 .\2.dll,must2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\rundll32.exerundll32 .\2.dll,must3⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\rundll32.exerundll32 .\2.dll,must4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
-
-
-