Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
-
Target
12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll
-
Size
898KB
-
MD5
88bbf2a743baaf81f7a312be61f90d76
-
SHA1
3719aabc29d5eb58d5d2d2a37066047c67bfc2c6
-
SHA256
12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305
-
SHA512
b01f955eb5f840e01f1f65d5f19c0963e155b1f8d03b4e0720eccbd397cc9aee9a19a63000719e3cf8f580573a335bd61f39fe1261f44e1d5371a9c695b60b70
-
SSDEEP
24576:qTm4c0TXhxdmVQGn88R7XM3Ljluc9KEaJqCjh0LmK8:6jP8Q13LjluSrCj+q/
Malware Config
Extracted
Family
qakbot
Botnet
tchk07
Campaign
1702975817
C2
116.203.56.11:443
109.107.181.8:443
Attributes
-
camp_date
2023-12-19 08:50:17 +0000 UTC
Signatures
-
Detect Qakbot Payload 13 IoCs
resource yara_rule behavioral2/memory/1688-0-0x0000015686FF0000-0x000001568701F000-memory.dmp family_qakbot_v5 behavioral2/memory/1688-5-0x00000156887F0000-0x000001568881E000-memory.dmp family_qakbot_v5 behavioral2/memory/1688-6-0x00000156887F0000-0x000001568881E000-memory.dmp family_qakbot_v5 behavioral2/memory/1688-4-0x0000015686FC0000-0x0000015686FED000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-8-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/1688-14-0x00000156887F0000-0x000001568881E000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-15-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-24-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-27-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-26-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-25-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-28-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 behavioral2/memory/2044-30-0x0000026DA5590000-0x0000026DA55BE000-memory.dmp family_qakbot_v5 -
Modifies registry class 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\4b015282 = 26c32360bbc85de09cc78298fceac9155f080c8736d7994f1ce0ce006d256750f1cbe61c90ad12e16f513fae8e8ec0c6bb0f3a2b73b235be528117e2d1b129778d4df494536af848be4b0b747340accabc wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\87ab521c = c554b911c10dbaebf639d5ebd0c38823da90912f6c25df0adcc1813d1b764c5768412078803d062cd1b88e7828a4b31ef61f4220c2c5118aab1f37a619e9a12e95297f24f72a3034b17426f2a301da33c4758b414c3e2d24419ba07d87679a8bcca84f53f2228d4a42af655dc3a3756b41fd2318cd5b022fcdb695f33dc6ab4d6a wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\98e44937 = 879fc572f19d11c97cae081bf899d2fdb4a8190bfc462bb822eb57f485c5f794fbfb0990fcc9f126167ade7853c13dc3e814cfdf213617e3ca0c16bb660501c42b0d8b0955429a99508da5e3655495ba18 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\996314b0 = 84b96278cd6127b2fdb68ff7431506670ed0781ee37a757eb789fb1cb7693ea1f915899aa0cdd9dfd994ed1ad64ac1edea wermgr.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\3e15ce6 = c5ddb9c2392083ad514f5511ad33835e8e7fc67d3888812d2b204b3f83c866b4c7d86b7021330ece80a4c7816249ea13ff wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\55c9142e = 45a7c07384380b87afb7ef4a90854136c1bccb839272d6c5d8ed5fb19182153758dbcc89f590bd2b5a5a519cbcebbc203a9e4a89abca5b24dda83e060aa7733ce2324bfdd1e2415bf3951b879327398e9fbb4c87caedb899ce13683871b4413c71ae0e9228309a149bfe996151cbc440535e8c633973121f1791746b78baa59857 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\544e49a9 = 27d57dac42875e7d6989be3569ebf00014721eba3a3cc659623d5ca6c770db7cf6956d4ccdd0e0377836c98b620c34cd4121e42fe75e19402ca00f1b6e4fcaef54df7eff3085bcbcbe2446b21d28fec6b209743efb62eb89a950b952914d17cacc4f61f3a749387ec1fd5541a75fa0801da6a1e19d78c5be2e9c6ec211bf5f44ed wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\2660161 = 64c067d66d0402decd4e80342d3f37f3fa472c9bfae0292fd23dede53beb057b8043c7776a74a541d38f3219b8ee721717 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\arlmoyecqunweao\3e15ce6 = e7c691f2c44e1bb0e7d14631d660a3407bc9dfc9cf70ac238c98665dd9eaf37f3cea419b6c5e4677f0dafa1d256e75f3c5c3c49c0ea8b243f4e8b742d25ce4b24139e2607b2c725e2a0a567b9791f902cf wermgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 rundll32.exe 1688 rundll32.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe 2044 wermgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2044 1688 rundll32.exe 87 PID 1688 wrote to memory of 2044 1688 rundll32.exe 87 PID 1688 wrote to memory of 2044 1688 rundll32.exe 87 PID 1688 wrote to memory of 2044 1688 rundll32.exe 87 PID 1688 wrote to memory of 2044 1688 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\wermgr.exeC:\Windows\System32\wermgr.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2044
-