Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/02/2025, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
d572b3f4f65b8186d98a128ef0c7cb7ff57b41e0a41b0791f04cb1b012000e83.dll
Resource
win7-20241010-en
General
-
Target
d572b3f4f65b8186d98a128ef0c7cb7ff57b41e0a41b0791f04cb1b012000e83.dll
-
Size
375KB
-
MD5
ac568b139f7830673ef152a4ca8b25cf
-
SHA1
7f5040c80f8a65fa53504cba1d5e60fb124aabbc
-
SHA256
d572b3f4f65b8186d98a128ef0c7cb7ff57b41e0a41b0791f04cb1b012000e83
-
SHA512
91a0989a723db81fb3519d59b7f7059b364129d6a37146bb51eafe3bbdc756945283e507546f8ddc60b69edb32324bd4538185336ccea8711def3405d57da3be
-
SSDEEP
6144:fvzgjtAxlMclgJkLF7E3VwdlFkB/TQpXnk5oEPxR9FDwlr9us:XItAx+DwdOb0GouxR94r
Malware Config
Extracted
qakbot
403.549
tr
1646817329
207.170.238.231:443
190.73.3.148:2222
84.241.8.23:32103
2.50.166.30:995
45.63.1.12:443
149.28.238.199:443
144.202.3.39:443
45.76.167.26:443
144.202.3.39:995
144.202.2.175:443
149.28.238.199:995
45.63.1.12:995
80.14.188.219:2222
45.76.167.26:995
176.67.56.94:443
47.180.172.159:443
117.248.109.38:21
75.99.168.194:443
140.82.49.12:443
82.152.39.39:443
91.177.173.10:995
176.253.27.51:443
140.82.63.183:443
140.82.63.183:995
24.178.196.158:2222
1.161.97.158:995
189.253.32.61:995
181.118.183.94:443
197.89.21.109:443
2.50.27.78:443
41.230.62.211:993
89.86.33.217:443
120.61.3.108:443
103.139.242.30:993
24.43.99.75:443
217.165.79.31:443
47.23.89.61:995
175.145.235.37:443
183.88.63.73:2222
47.23.89.61:993
86.98.11.110:443
86.97.209.134:1194
197.37.66.133:995
173.174.216.62:443
217.165.79.31:995
70.57.207.83:443
69.159.200.138:2222
208.107.221.224:443
217.165.85.106:993
39.44.188.102:995
136.143.11.232:443
41.84.244.32:995
5.95.58.211:2087
89.101.97.139:443
176.57.126.138:443
75.99.168.194:61201
41.130.133.118:995
81.229.130.188:443
71.13.93.154:2222
139.64.13.51:995
70.46.220.114:443
128.106.122.181:443
114.79.148.170:443
103.139.242.30:990
80.11.74.81:2222
196.203.37.215:80
144.202.2.175:995
31.35.28.29:443
75.159.9.236:443
190.189.33.6:32101
182.191.92.203:995
39.52.62.239:995
93.48.80.198:995
76.70.9.169:2222
183.82.103.213:443
120.150.218.241:995
67.209.195.198:443
217.128.122.65:2222
38.70.253.226:2222
76.25.142.196:443
92.99.229.158:2222
32.221.231.1:443
78.100.194.196:6883
96.246.158.154:995
124.41.193.166:443
89.211.185.240:2222
197.164.168.41:993
186.10.247.110:443
79.167.199.210:995
45.9.20.200:443
197.237.74.185:995
96.21.251.127:2222
92.177.45.46:2078
206.217.0.154:995
63.153.150.20:443
70.163.1.219:443
72.76.94.99:443
2.50.40.80:61200
188.50.4.45:995
172.114.160.81:995
209.210.95.228:32100
119.158.105.8:995
74.15.2.252:2222
78.169.100.120:443
105.186.100.243:995
103.87.95.131:2222
108.4.67.252:443
1.161.97.158:443
121.74.187.191:995
41.228.22.180:443
173.21.10.71:2222
86.98.48.115:995
102.140.71.59:443
71.74.12.34:443
189.146.51.56:443
173.170.224.168:995
191.99.191.28:443
73.151.236.31:443
216.10.217.114:443
76.169.147.192:32103
47.180.172.159:50010
187.170.7.81:443
47.156.191.217:443
201.170.181.247:443
5.32.41.45:443
172.114.160.81:443
72.252.201.34:990
100.1.108.246:443
72.12.115.90:22
70.51.139.58:2222
72.252.201.34:995
208.101.87.135:443
40.134.247.125:995
68.204.7.158:443
105.187.31.228:995
187.59.18.65:443
63.143.92.99:995
31.215.70.101:443
109.12.111.14:443
24.55.67.176:443
191.112.19.94:443
41.84.246.125:443
83.110.218.135:32101
118.189.242.45:2083
39.52.217.44:995
89.137.52.44:443
217.164.120.130:2222
203.109.249.50:995
86.195.158.178:2222
66.230.104.103:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 regsvr32.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe 2944 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2988 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2108 wrote to memory of 2988 2108 regsvr32.exe 30 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2944 2988 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d572b3f4f65b8186d98a128ef0c7cb7ff57b41e0a41b0791f04cb1b012000e83.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d572b3f4f65b8186d98a128ef0c7cb7ff57b41e0a41b0791f04cb1b012000e83.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-