Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
26/02/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll
Resource
win7-20240221-en
windows7-x64
General
- Target a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll
- Size 515KB
- Sample240226-1m1wwagg95
- SHA256 a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579
- MD5 ee91b04ce7d49a76c987c4aa4e269300
- SHA1 9ebae6f3c883c8d8d7f6c8b6b886105d910f9c1a
- SHA512 a150d9d688a0f6a6c2c52e75b62fd2c4bdcd4f1e432b27b090bcd458272de4c6f73e5adbf50acbe82b21aa99593efdd92354d47a7c24515d115a4e35311c7303
- SSDEEP 12288:2VLOLbYx29jcKY/1Yj70xFqSgzHkuyEFDOwK:Syy2K120/bgzEuyEFC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
qakbot
-
403.549
-
AA
-
1648020400
-
120.150.218.241:995
-
79.52.204.9:50001
-
161.142.56.8:443
-
93.48.80.198:995
-
81.60.216.223:995
-
1.161.80.99:443
-
2.34.12.8:443
-
113.11.89.170:995
-
74.15.2.252:2222
-
209.180.70.25:443
-
86.98.208.214:2222
-
189.146.51.56:443
-
203.122.46.130:443
-
190.73.3.148:2222
-
197.167.50.74:993
-
76.70.9.169:2222
-
75.99.168.194:443
-
76.69.155.202:2222
-
176.88.238.122:995
-
89.137.52.44:443
-
76.169.147.192:32103
-
108.60.213.141:443
-
176.67.56.94:443
-
148.64.96.100:443
-
47.180.172.159:443
-
208.107.221.224:443
-
140.82.49.12:443
-
96.21.251.127:2222
-
70.51.135.39:2222
-
2.42.176.91:443
-
92.177.45.46:2078
-
105.186.127.127:995
-
78.87.36.171:995
-
83.110.85.209:443
-
31.35.28.29:443
-
120.61.2.249:443
-
206.217.0.154:995
-
78.188.76.167:443
-
24.43.99.75:443
-
37.186.54.166:995
-
5.32.41.45:443
-
201.172.231.204:443
-
47.23.89.62:993
-
72.76.94.99:443
-
47.180.172.159:50010
-
86.98.27.253:443
-
75.99.168.194:61201
-
197.89.109.60:443
-
45.9.20.200:443
-
173.174.216.62:443
-
121.74.182.236:995
-
140.82.63.183:995
-
45.63.1.12:443
-
45.76.167.26:995
-
45.63.1.12:995
-
144.202.2.175:995
-
144.202.2.175:443
-
45.76.167.26:443
-
144.202.3.39:995
-
149.28.238.199:443
-
149.28.238.199:995
-
140.82.63.183:443
-
144.202.3.39:443
-
129.208.61.75:995
-
71.13.93.154:2222
-
91.177.173.10:995
-
83.110.85.209:995
-
47.23.89.62:995
-
70.57.207.83:443
-
1.161.80.99:995
-
207.170.238.231:443
-
175.145.235.37:443
-
190.206.211.182:443
-
32.221.225.247:995
-
217.164.118.117:1194
-
69.159.200.138:2222
-
180.233.150.134:995
-
103.87.95.131:2222
-
70.46.220.114:443
-
172.115.177.204:2222
-
31.215.69.127:443
-
172.114.160.81:995
-
67.209.195.198:443
-
75.159.9.236:443
-
24.178.196.158:2222
-
41.228.22.180:443
-
217.165.85.224:993
-
37.152.80.105:443
-
217.128.122.65:2222
-
24.152.219.253:995
-
195.32.57.18:80
-
103.88.226.82:443
-
173.21.10.71:2222
-
73.151.236.31:443
-
197.92.138.54:443
-
102.140.70.236:443
-
174.69.215.101:443
-
71.74.12.34:443
-
47.156.191.217:443
-
191.99.191.28:443
-
148.64.96.100:993
-
201.145.226.223:443
-
189.237.6.251:443
-
201.170.181.247:443
-
201.103.6.221:443
-
72.252.201.34:990
-
72.252.201.34:995
-
100.1.108.246:443
-
72.12.115.90:22
-
109.12.111.14:443
-
40.134.246.185:995
-
24.55.67.176:443
-
63.143.92.99:995
-
24.229.150.54:995
-
105.225.175.168:995
-
89.101.97.139:443
-
179.178.78.112:443
-
143.0.34.185:443
-
108.4.67.252:443
-
81.132.186.248:2078
-
114.79.148.170:443
-
200.100.246.85:32101
-
217.164.118.117:2222
-
45.46.53.140:2222
-
82.152.39.39:443
-
186.105.118.4:443
-
67.165.206.193:993
-
196.203.37.215:80
-
197.238.216.127:443
-
39.44.151.33:995
-
75.188.35.168:443
-
80.11.74.81:2222
-
5.95.58.211:2087
-
182.191.92.203:995
-
180.129.26.139:995
-
186.10.247.110:443
-
111.125.245.118:995
-
217.165.85.73:32101
-
177.134.208.155:995
-
197.162.105.58:995
-
124.41.193.166:443
-
118.173.98.236:443
-
117.248.109.38:21
-
103.233.141.26:2222
-
110.143.139.163:443
-
98.22.244.189:443
-
76.25.142.196:443
-
38.70.253.226:2222
-
76.119.110.181:443
-
173.22.32.101:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 regsvr32.exe 1980 regsvr32.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe 2012 explorer.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1980 regsvr32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1980 1976 regsvr32.exe 82 PID 1976 wrote to memory of 1980 1976 regsvr32.exe 82 PID 1976 wrote to memory of 1980 1976 regsvr32.exe 82 PID 1980 wrote to memory of 2012 1980 regsvr32.exe 85 PID 1980 wrote to memory of 2012 1980 regsvr32.exe 85 PID 1980 wrote to memory of 2012 1980 regsvr32.exe 85 PID 1980 wrote to memory of 2012 1980 regsvr32.exe 85 PID 1980 wrote to memory of 2012 1980 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-