Resubmissions
30-11-2023 22:16
231130-164rwacb43 1030-11-2023 22:13
231130-1472hsca42 1029-11-2023 16:48
231129-vbamnaab9w 10Analysis
-
max time kernel
20s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
30-11-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll
Resource
win7-20231023-en
General
-
Target
799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll
-
Size
695KB
-
MD5
7f848e8045da39b62f447cfefcfbc4d0
-
SHA1
19434176868e295ae703d60e61751d9f755831bd
-
SHA256
799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81
-
SHA512
a98f36849b10d34a67dddb6e604385ddb8759cbe31027a5da4d53267289b0e43cc53f05b2e54ec4309bbd2dcb7ba86ef0fa1cde2bb5dc23ebd61db10cb96c6a8
-
SSDEEP
12288:nieL1vc1PdFjpmw5qS6xnGWPE/N285UT+QD1lNMA:i81IFnqnPEl5w9M
Malware Config
Extracted
qakbot
403.895
obama207
1664363417
217.165.146.158:993
41.97.179.58:443
86.132.13.49:2078
197.203.50.195:443
85.245.143.94:443
86.196.181.62:2222
102.190.190.242:995
105.184.133.198:995
179.111.23.186:32101
179.251.119.206:995
84.3.85.30:443
39.44.5.104:995
197.41.235.69:995
193.3.19.137:443
186.81.122.168:443
103.173.121.17:443
41.104.80.233:443
102.189.184.12:995
156.199.90.139:443
14.168.180.223:443
41.140.98.37:995
156.205.3.210:993
139.228.33.176:2222
134.35.12.0:443
49.205.197.13:443
131.100.40.13:995
73.252.27.208:995
82.217.55.20:443
176.177.136.35:443
180.232.159.9:443
41.68.209.102:995
186.90.144.235:2222
191.92.125.254:443
41.96.204.133:443
58.186.75.42:443
85.86.242.245:443
187.193.143.111:443
200.175.173.80:443
197.49.68.15:995
186.50.139.45:995
41.68.155.190:443
186.72.236.88:995
187.150.143.159:443
105.69.189.28:995
160.177.207.113:8443
41.102.97.28:443
193.254.32.156:443
88.168.84.62:443
156.218.169.48:995
41.105.159.42:443
186.53.115.151:995
186.48.206.63:995
151.231.60.200:2083
196.217.32.15:443
102.157.212.143:443
189.189.89.32:443
181.177.156.209:443
85.94.178.73:995
201.209.4.2:443
41.69.236.243:995
74.133.189.36:443
149.126.159.254:443
41.104.132.166:443
188.157.6.170:443
197.160.22.10:443
187.189.68.8:443
109.128.221.164:995
92.98.73.123:443
154.237.235.43:995
212.102.56.47:443
110.238.39.214:443
185.233.79.238:995
154.237.60.254:995
181.206.46.7:443
186.16.163.94:443
75.71.96.226:995
181.105.32.5:443
41.227.228.31:443
197.203.142.42:443
118.174.89.216:443
41.107.112.236:995
105.96.207.25:443
111.125.157.230:443
68.224.229.42:443
190.44.40.48:995
88.232.207.24:443
72.88.245.71:443
119.82.111.158:443
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
197.94.84.128:443
41.96.130.46:80
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
76.169.76.44:2222
68.53.110.74:995
41.69.103.179:995
194.166.205.204:995
89.211.223.138:2222
85.98.206.165:995
177.103.94.155:32101
72.66.96.129:995
176.42.245.2:995
186.154.92.181:443
88.231.221.198:995
102.38.97.229:995
45.51.148.111:993
87.243.113.104:995
84.38.133.191:443
123.240.131.1:443
191.84.204.214:995
91.116.160.252:443
151.234.63.48:990
99.253.251.74:443
41.40.146.5:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe PID 1956 wrote to memory of 2056 1956 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\799b7a01e7941fa8baf90b3bc4c6397ca2974429b835949540b0b88162f4fc81dll.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2056-0-0x0000000000210000-0x00000000002C3000-memory.dmpFilesize
716KB
-
memory/2056-1-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/2056-3-0x00000000003E0000-0x0000000000402000-memory.dmpFilesize
136KB
-
memory/2056-2-0x00000000003E0000-0x0000000000402000-memory.dmpFilesize
136KB
-
memory/2056-4-0x0000000000A80000-0x0000000000AC2000-memory.dmpFilesize
264KB
-
memory/2056-5-0x0000000000210000-0x00000000002C3000-memory.dmpFilesize
716KB