Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2023, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
4000hz.dll
Resource
win7-20230220-en
windows7-x64
General
-
Target
4000hz.dll
-
Size
1.2MB
-
MD5
3106a030a6f3083be7e5809727687e4b
-
SHA1
dcf81a4b10c7d6122fc68253172fef4cf59aebbf
-
SHA256
81e49a38bf964c207c561656295ec4d349c40239342fa59ed761cb4efad9490d
-
SHA512
395e086eb3dee1823c2dc2a608bde147387185a889207212c3c9cc29d092ac623ea572c83753deb52d581bfabc3e354a263474a8e2b5669ea4b4b1741eef297a
-
SSDEEP
24576:KGSbIuGSom9C0k1HH1cqj06uPi2bro8nuuDYmc1WpFgiYnGn6AW:Kf8r9W01Gn6
Malware Config
Extracted
qakbot
404.1374
BB32
1686908761
86.176.144.175:2222
86.248.228.57:2078
88.171.156.150:50000
183.87.163.165:443
45.201.208.87:443
74.12.147.205:2222
96.87.28.170:2222
70.28.50.223:32100
220.79.238.82:443
12.172.173.82:995
45.2.61.134:3389
70.160.67.203:443
103.141.50.45:995
88.126.94.4:50000
70.28.50.223:3389
142.181.206.222:2222
51.37.181.9:443
223.166.13.95:995
162.248.14.107:443
95.45.50.93:2222
213.64.33.92:2222
213.91.235.146:443
189.223.184.79:443
47.34.30.133:443
70.28.50.223:2087
12.172.173.82:465
47.205.25.170:443
39.40.59.71:2222
103.140.174.20:2222
66.241.183.99:443
23.234.237.3:443
12.172.173.82:993
203.109.44.236:995
174.4.89.3:443
88.122.221.227:443
84.35.26.14:995
142.154.32.124:443
184.82.238.145:443
24.234.220.88:993
12.172.173.82:50001
217.129.220.205:443
92.9.45.20:2222
90.29.86.138:2222
91.169.12.198:32100
12.172.173.82:20
70.28.50.223:2078
188.28.19.84:443
92.20.204.198:2222
92.186.69.229:2222
161.142.100.114:995
197.26.147.241:995
199.27.66.213:443
41.97.30.206:443
136.232.179.26:443
200.112.67.75:32100
92.97.227.66:2222
197.0.146.211:443
176.142.207.63:443
37.14.229.220:2222
184.181.75.148:443
89.181.227.42:2222
89.114.140.100:443
181.230.169.180:443
103.176.239.98:443
41.100.36.90:443
103.123.223.153:443
184.182.66.109:443
70.28.50.223:2083
47.21.51.138:443
77.126.99.230:443
12.172.173.82:32101
116.88.76.28:443
116.74.163.180:443
72.4.96.62:443
71.30.208.132:995
178.175.187.254:443
24.234.220.88:995
24.234.220.88:465
70.28.50.223:1194
85.61.165.153:2222
217.165.255.105:443
119.82.91.60:2078
121.121.100.202:995
105.186.242.215:995
81.229.117.95:2222
41.129.104.142:443
12.172.173.82:21
122.184.143.86:443
85.240.173.251:2078
70.48.46.235:2222
124.122.47.148:443
114.143.176.237:443
86.160.253.50:443
184.176.35.223:2222
172.115.17.50:443
47.199.241.39:443
124.246.122.199:2222
89.32.156.4:995
92.149.250.113:2222
87.149.116.32:995
72.205.104.134:443
110.159.115.244:443
82.127.153.75:2222
64.121.161.102:443
187.199.244.117:32103
12.172.173.82:2087
74.12.147.205:2083
84.213.236.225:995
86.164.33.69:995
98.4.43.111:443
79.168.224.165:2222
197.204.28.90:443
89.129.109.27:2222
76.178.148.107:2222
77.86.98.236:443
83.114.60.6:2222
90.78.147.141:2222
201.244.108.183:995
45.62.75.217:443
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 748 rundll32.exe 748 rundll32.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe 4804 wermgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5084 wrote to memory of 748 5084 rundll32.exe 83 PID 5084 wrote to memory of 748 5084 rundll32.exe 83 PID 5084 wrote to memory of 748 5084 rundll32.exe 83 PID 748 wrote to memory of 4804 748 rundll32.exe 84 PID 748 wrote to memory of 4804 748 rundll32.exe 84 PID 748 wrote to memory of 4804 748 rundll32.exe 84 PID 748 wrote to memory of 4804 748 rundll32.exe 84 PID 748 wrote to memory of 4804 748 rundll32.exe 84 PID 748 wrote to memory of 4804 748 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4000hz.dll,must1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4000hz.dll,must2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-