Analysis
- max time kernel
150s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2023, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
Marechal.dll
Resource
win7-20230220-en
windows7-x64
General
- Target Marechal.dll
- Size 1.9MB
- Sample230620-lr98sabc24
- SHA256 e7bb9d7465c2b26925434980de273231481d1cc532530201d65ba834e3f1953c
- MD5 fe2f17174c5cbb9cdabe70dce4b51b8e
- SHA1 d5336386af73689a8f4dc2fcbe3d7bd422469d4d
- SHA512 07697b7dc60fe0e80d841ed533760eafc211b5a00f459431aaef163f2b7eb4159fecbaf948a84b58327081561f6979d66292bc1a5abc9eb8363cbb9b1af31509
- SSDEEP 24576:WA2fv3u6Bi9VqNOso4wItgDmn6mYMy2JXSwu9jpTyk:WA2H3li98M141ZYMyiSl8k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
404.1382
-
BB33
-
1687242247
-
201.171.159.196:443
-
192.252.166.24:80
-
176.44.123.169:995
-
2.82.8.80:443
-
81.150.169.174:2083
-
74.12.147.68:2222
-
86.248.228.57:2078
-
70.160.67.203:443
-
75.109.111.89:443
-
88.126.94.4:50000
-
70.28.50.223:3389
-
223.166.13.95:995
-
162.248.14.107:443
-
70.28.50.223:32100
-
84.35.26.14:995
-
12.172.173.82:995
-
183.87.163.165:443
-
92.186.69.229:2222
-
12.172.173.82:993
-
174.4.89.3:443
-
199.27.66.213:443
-
12.172.173.82:50001
-
81.229.117.95:2222
-
92.9.45.20:2222
-
12.172.173.82:20
-
91.169.12.198:32100
-
213.91.235.146:443
-
12.172.173.82:465
-
70.28.50.223:2078
-
75.98.154.19:443
-
136.232.179.26:443
-
67.87.119.216:2078
-
103.123.223.131:443
-
94.204.121.72:443
-
103.140.174.20:2222
-
95.45.50.93:2222
-
72.4.96.62:443
-
176.142.207.63:443
-
213.64.33.92:2222
-
47.34.30.133:443
-
70.28.50.223:2087
-
47.205.25.170:443
-
81.150.169.174:2078
-
81.150.169.174:2087
-
89.158.150.253:443
-
66.241.183.99:443
-
188.28.22.221:443
-
23.234.237.3:443
-
181.230.169.180:443
-
184.182.66.109:443
-
70.28.50.223:2083
-
175.156.65.126:2222
-
64.229.117.208:2222
-
77.126.99.230:443
-
87.252.106.235:995
-
12.172.173.82:32101
-
161.142.100.114:995
-
24.234.220.88:995
-
70.28.50.223:1194
-
24.234.80.122:995
-
81.150.169.174:2222
-
121.121.100.202:995
-
105.186.138.229:995
-
27.0.48.233:443
-
80.6.50.34:443
-
12.172.173.82:21
-
197.3.227.63:443
-
68.6.237.243:443
-
87.149.116.32:995
-
103.212.19.254:995
-
90.104.151.37:2222
-
178.175.187.254:443
-
86.170.169.53:443
-
119.82.71.94:2078
-
90.7.72.46:2222
-
217.165.255.105:443
-
116.88.76.28:443
-
125.99.69.177:443
-
73.155.10.79:443
-
103.141.50.46:995
-
142.181.206.222:2222
-
47.199.241.39:443
-
96.255.66.51:995
-
64.121.161.102:443
-
60.189.130.84:995
-
187.199.244.117:32103
-
110.159.115.244:443
-
72.205.104.134:443
-
12.172.173.82:2087
-
79.168.224.165:2222
-
81.157.120.247:443
-
124.122.47.219:443
-
201.227.113.134:2222
-
103.144.201.52:2078
-
103.139.243.205:443
-
86.160.253.50:443
-
103.87.128.228:443
-
201.244.108.183:995
-
38.2.18.164:443
-
71.31.9.226:995
-
45.62.75.217:443
-
182.75.189.42:995
-
91.160.70.68:32100
-
103.134.117.111:443
-
24.234.220.88:990
-
102.182.81.253:443
-
96.87.28.170:2222
-
1.221.179.74:443
-
86.164.33.69:995
-
49.175.72.81:443
-
12.172.173.82:22
-
203.109.44.236:995
-
70.50.1.252:2222
-
168.149.47.12:443
-
68.186.65.132:443
-
113.11.92.30:443
-
24.138.87.122:995
-
76.9.168.249:443
-
173.17.45.60:443
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5060 rundll32.exe 5060 rundll32.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe 4532 wermgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4180 wrote to memory of 5060 4180 rundll32.exe 86 PID 4180 wrote to memory of 5060 4180 rundll32.exe 86 PID 4180 wrote to memory of 5060 4180 rundll32.exe 86 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87 PID 5060 wrote to memory of 4532 5060 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Marechal.dll,more1⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Marechal.dll,more2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532
-
-