Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2023, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
loader/10.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
loader/10.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
loader/loader.bat
Resource
win7-20230220-en
windows7-x64
General
- Target loader/loader.bat
- Size 40B
- Sample230620-thbymach77
- SHA256 c44c93c9d9c34c1899762799a0376c0f40372c6e15a2e4daec2b55ed0b95532f
- MD5 ad8e5b0a3c7308cfa87898e8ef38635d
- SHA1 0d3f3b730e13e00b4499d82d3a637055d9a81f33
- SHA512 bbb21e66bd73895f5c5dab5f51287ccf70269ef763c0e47af26b45bd1283fdefa903a058e107cf30eb3c8d7090eae82e7c67c0ef80f1ae88b37c66fb74ab0464
- MD5 SHA1 SHA512
Malware Config
Extracted
-
qakbot
-
404.1382
-
BB33
-
1687242247
-
201.171.159.196:443
-
192.252.166.24:80
-
176.44.123.169:995
-
2.82.8.80:443
-
81.150.169.174:2083
-
74.12.147.68:2222
-
86.248.228.57:2078
-
70.160.67.203:443
-
75.109.111.89:443
-
88.126.94.4:50000
-
70.28.50.223:3389
-
223.166.13.95:995
-
162.248.14.107:443
-
70.28.50.223:32100
-
84.35.26.14:995
-
12.172.173.82:995
-
183.87.163.165:443
-
92.186.69.229:2222
-
12.172.173.82:993
-
174.4.89.3:443
-
199.27.66.213:443
-
12.172.173.82:50001
-
81.229.117.95:2222
-
92.9.45.20:2222
-
12.172.173.82:20
-
91.169.12.198:32100
-
213.91.235.146:443
-
12.172.173.82:465
-
70.28.50.223:2078
-
75.98.154.19:443
-
136.232.179.26:443
-
67.87.119.216:2078
-
103.123.223.131:443
-
94.204.121.72:443
-
103.140.174.20:2222
-
95.45.50.93:2222
-
72.4.96.62:443
-
176.142.207.63:443
-
213.64.33.92:2222
-
47.34.30.133:443
-
70.28.50.223:2087
-
47.205.25.170:443
-
81.150.169.174:2078
-
81.150.169.174:2087
-
89.158.150.253:443
-
66.241.183.99:443
-
188.28.22.221:443
-
23.234.237.3:443
-
181.230.169.180:443
-
184.182.66.109:443
-
70.28.50.223:2083
-
175.156.65.126:2222
-
64.229.117.208:2222
-
77.126.99.230:443
-
87.252.106.235:995
-
12.172.173.82:32101
-
161.142.100.114:995
-
24.234.220.88:995
-
70.28.50.223:1194
-
24.234.80.122:995
-
81.150.169.174:2222
-
121.121.100.202:995
-
105.186.138.229:995
-
27.0.48.233:443
-
80.6.50.34:443
-
12.172.173.82:21
-
197.3.227.63:443
-
68.6.237.243:443
-
87.149.116.32:995
-
103.212.19.254:995
-
90.104.151.37:2222
-
178.175.187.254:443
-
86.170.169.53:443
-
119.82.71.94:2078
-
90.7.72.46:2222
-
217.165.255.105:443
-
116.88.76.28:443
-
125.99.69.177:443
-
73.155.10.79:443
-
103.141.50.46:995
-
142.181.206.222:2222
-
47.199.241.39:443
-
96.255.66.51:995
-
64.121.161.102:443
-
60.189.130.84:995
-
187.199.244.117:32103
-
110.159.115.244:443
-
72.205.104.134:443
-
12.172.173.82:2087
-
79.168.224.165:2222
-
81.157.120.247:443
-
124.122.47.219:443
-
201.227.113.134:2222
-
103.144.201.52:2078
-
103.139.243.205:443
-
86.160.253.50:443
-
103.87.128.228:443
-
201.244.108.183:995
-
38.2.18.164:443
-
71.31.9.226:995
-
45.62.75.217:443
-
182.75.189.42:995
-
91.160.70.68:32100
-
103.134.117.111:443
-
24.234.220.88:990
-
102.182.81.253:443
-
96.87.28.170:2222
-
1.221.179.74:443
-
86.164.33.69:995
-
49.175.72.81:443
-
12.172.173.82:22
-
203.109.44.236:995
-
70.50.1.252:2222
-
168.149.47.12:443
-
68.186.65.132:443
-
113.11.92.30:443
-
24.138.87.122:995
-
76.9.168.249:443
-
173.17.45.60:443
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4840 rundll32.exe 4840 rundll32.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe 3760 wermgr.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1320 wrote to memory of 4384 1320 cmd.exe 85 PID 1320 wrote to memory of 4384 1320 cmd.exe 85 PID 4384 wrote to memory of 4316 4384 cmd.exe 86 PID 4384 wrote to memory of 4316 4384 cmd.exe 86 PID 4316 wrote to memory of 4840 4316 rundll32.exe 87 PID 4316 wrote to memory of 4840 4316 rundll32.exe 87 PID 4316 wrote to memory of 4840 4316 rundll32.exe 87 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88 PID 4840 wrote to memory of 3760 4840 rundll32.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\loader\loader.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\cmd.execmd /c rundll32 .\10.dll,more2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\system32\rundll32.exerundll32 .\10.dll,more3⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\rundll32.exerundll32 .\10.dll,more4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
-
-