Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/02/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll
Resource
win7-20240221-en
windows7-x64
General
-
Target
a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll
-
Size
515KB
-
MD5
ee91b04ce7d49a76c987c4aa4e269300
-
SHA1
9ebae6f3c883c8d8d7f6c8b6b886105d910f9c1a
-
SHA256
a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579
-
SHA512
a150d9d688a0f6a6c2c52e75b62fd2c4bdcd4f1e432b27b090bcd458272de4c6f73e5adbf50acbe82b21aa99593efdd92354d47a7c24515d115a4e35311c7303
-
SSDEEP
12288:2VLOLbYx29jcKY/1Yj70xFqSgzHkuyEFDOwK:Syy2K120/bgzEuyEFC
Malware Config
Extracted
qakbot
403.549
AA
1648020400
120.150.218.241:995
79.52.204.9:50001
161.142.56.8:443
93.48.80.198:995
81.60.216.223:995
1.161.80.99:443
2.34.12.8:443
113.11.89.170:995
74.15.2.252:2222
209.180.70.25:443
86.98.208.214:2222
189.146.51.56:443
203.122.46.130:443
190.73.3.148:2222
197.167.50.74:993
76.70.9.169:2222
75.99.168.194:443
76.69.155.202:2222
176.88.238.122:995
89.137.52.44:443
76.169.147.192:32103
108.60.213.141:443
176.67.56.94:443
148.64.96.100:443
47.180.172.159:443
208.107.221.224:443
140.82.49.12:443
96.21.251.127:2222
70.51.135.39:2222
2.42.176.91:443
92.177.45.46:2078
105.186.127.127:995
78.87.36.171:995
83.110.85.209:443
31.35.28.29:443
120.61.2.249:443
206.217.0.154:995
78.188.76.167:443
24.43.99.75:443
37.186.54.166:995
5.32.41.45:443
201.172.231.204:443
47.23.89.62:993
72.76.94.99:443
47.180.172.159:50010
86.98.27.253:443
75.99.168.194:61201
197.89.109.60:443
45.9.20.200:443
173.174.216.62:443
121.74.182.236:995
140.82.63.183:995
45.63.1.12:443
45.76.167.26:995
45.63.1.12:995
144.202.2.175:995
144.202.2.175:443
45.76.167.26:443
144.202.3.39:995
149.28.238.199:443
149.28.238.199:995
140.82.63.183:443
144.202.3.39:443
129.208.61.75:995
71.13.93.154:2222
91.177.173.10:995
83.110.85.209:995
47.23.89.62:995
70.57.207.83:443
1.161.80.99:995
207.170.238.231:443
175.145.235.37:443
190.206.211.182:443
32.221.225.247:995
217.164.118.117:1194
69.159.200.138:2222
180.233.150.134:995
103.87.95.131:2222
70.46.220.114:443
172.115.177.204:2222
31.215.69.127:443
172.114.160.81:995
67.209.195.198:443
75.159.9.236:443
24.178.196.158:2222
41.228.22.180:443
217.165.85.224:993
37.152.80.105:443
217.128.122.65:2222
24.152.219.253:995
195.32.57.18:80
103.88.226.82:443
173.21.10.71:2222
73.151.236.31:443
197.92.138.54:443
102.140.70.236:443
174.69.215.101:443
71.74.12.34:443
47.156.191.217:443
191.99.191.28:443
148.64.96.100:993
201.145.226.223:443
189.237.6.251:443
201.170.181.247:443
201.103.6.221:443
72.252.201.34:990
72.252.201.34:995
100.1.108.246:443
72.12.115.90:22
109.12.111.14:443
40.134.246.185:995
24.55.67.176:443
63.143.92.99:995
24.229.150.54:995
105.225.175.168:995
89.101.97.139:443
179.178.78.112:443
143.0.34.185:443
108.4.67.252:443
81.132.186.248:2078
114.79.148.170:443
200.100.246.85:32101
217.164.118.117:2222
45.46.53.140:2222
82.152.39.39:443
186.105.118.4:443
67.165.206.193:993
196.203.37.215:80
197.238.216.127:443
39.44.151.33:995
75.188.35.168:443
80.11.74.81:2222
5.95.58.211:2087
182.191.92.203:995
180.129.26.139:995
186.10.247.110:443
111.125.245.118:995
217.165.85.73:32101
177.134.208.155:995
197.162.105.58:995
124.41.193.166:443
118.173.98.236:443
117.248.109.38:21
103.233.141.26:2222
110.143.139.163:443
98.22.244.189:443
76.25.142.196:443
38.70.253.226:2222
76.119.110.181:443
173.22.32.101:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 regsvr32.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2764 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2764 1948 regsvr32.exe 28 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29 PID 2764 wrote to memory of 1624 2764 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-