Analysis
-
max time kernel
104s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2023 02:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.3773.dll
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.3773.dll
Resource
win10v2004-20230220-en
2 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.3773.dll
-
Size
246KB
-
MD5
e3d868d2ac96d2bbdb9341e992e7ae74
-
SHA1
636d0c6c24f261f24713e0eaa426e3979721ae57
-
SHA256
26038e0e851afb5c8e3d7a52ceeca87704de51a3c50664e510c7a6ed14710bff
-
SHA512
ce13e101d37c0859791875b445fb3624aaf634679836f080f702eb1b5b5356ac5dca7dc4d7eafc1f5ae4c1ac835022c3243f6f34ca9f884788885c403da5ce47
-
SSDEEP
6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzO:cRwBEZp11EFcUTzO
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4524 4776 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4896 wrote to memory of 4776 4896 rundll32.exe rundll32.exe PID 4896 wrote to memory of 4776 4896 rundll32.exe rundll32.exe PID 4896 wrote to memory of 4776 4896 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.3773.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.QakBot.RDB.MTB.3773.dll,#12⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 6003⤵
- Program crash
PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4776 -ip 47761⤵PID:4120