Analysis
-
max time kernel
128s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-11-2020 15:11
Static task
static1
Behavioral task
behavioral1
Sample
a88f4c170e11eda9a789765001a84fb1.dll
Resource
win7v20201028
General
-
Target
a88f4c170e11eda9a789765001a84fb1.dll
-
Size
271KB
-
MD5
a88f4c170e11eda9a789765001a84fb1
-
SHA1
b274da255232e48ab19e9b478f29ffd54f885a76
-
SHA256
ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7
-
SHA512
f5cd24cfd484d0ab54b7b0d0115005ab808d4bdde446380a2d2e9ab5a3f29265152e9139ba79fe8844be658afc7d41641ba71fa4f0fe050db4315d1055c3cf70
Malware Config
Extracted
qakbot
tr02
1606301054
59.98.96.143:443
86.122.248.164:2222
101.185.175.169:2222
71.187.170.235:443
92.59.35.196:2222
188.52.193.110:995
90.175.88.99:2222
37.107.111.46:995
96.237.141.134:995
2.50.143.154:2078
109.205.204.229:2222
90.101.62.189:2222
41.228.220.155:443
190.128.215.174:443
188.26.243.119:443
79.113.247.80:443
82.76.47.211:443
73.248.120.240:443
72.36.59.46:2222
74.129.26.119:443
24.152.219.253:995
37.116.152.122:2222
83.202.68.220:2222
5.13.75.120:443
216.215.77.18:2078
24.122.0.90:443
197.135.88.225:995
73.55.254.225:443
68.192.50.231:443
188.24.155.168:443
116.240.78.45:995
50.244.112.90:443
140.82.27.132:443
178.87.29.72:443
201.152.196.4:443
174.101.35.214:443
83.110.220.105:443
194.243.78.225:443
45.32.162.253:443
2.49.219.254:22
45.32.165.134:443
71.126.139.251:443
72.186.1.237:443
105.96.27.117:443
77.27.174.49:995
70.124.29.226:443
113.22.243.219:443
89.32.220.24:443
71.182.142.63:443
84.224.55.148:995
151.60.51.86:443
69.123.179.70:443
94.69.112.148:2222
151.27.111.246:443
80.227.5.70:443
86.98.10.63:2222
219.76.148.249:443
80.14.22.234:2222
95.76.27.6:443
116.240.76.97:0
73.56.2.167:443
83.110.74.87:443
47.187.49.3:2222
58.152.9.133:443
85.105.29.218:443
77.30.214.26:443
78.187.125.116:2222
83.110.110.155:443
85.186.122.190:443
62.38.114.12:2222
71.74.12.34:443
2.50.143.154:2222
51.223.61.13:443
69.11.247.242:443
120.151.95.167:443
98.16.204.189:995
86.245.87.251:2222
108.31.15.10:995
64.185.5.157:443
86.248.30.56:2222
84.232.252.202:2222
64.121.114.87:443
84.78.128.76:2222
81.88.254.62:443
74.134.184.114:443
77.159.149.74:443
85.60.132.8:2222
72.28.255.159:995
68.46.142.48:995
72.66.47.70:443
47.146.39.147:443
109.154.186.39:2222
71.88.104.107:443
68.15.109.125:443
149.135.101.20:443
68.190.152.98:443
69.40.22.180:443
37.104.30.154:995
66.26.160.37:443
208.99.100.129:443
184.21.136.237:443
31.35.28.29:443
161.142.217.62:443
182.48.138.42:443
103.26.221.230:2222
86.97.162.141:2222
73.166.10.38:443
172.87.157.235:443
83.110.158.124:2222
2.89.183.206:443
96.241.66.126:443
83.110.74.169:443
86.98.89.75:2222
172.78.30.215:443
207.162.184.228:443
79.172.26.240:443
217.165.15.245:2222
24.205.33.145:6881
80.106.85.24:2222
197.82.221.226:443
106.51.52.111:443
80.195.103.146:2222
47.146.169.85:443
24.178.196.158:443
2.50.3.98:443
99.234.121.250:443
184.66.18.83:443
85.98.177.32:443
68.186.192.69:443
216.215.77.18:2222
199.116.241.147:443
24.39.132.106:2087
68.174.15.223:443
180.233.150.134:443
151.73.126.156:443
134.0.196.46:995
98.32.7.217:443
85.60.132.8:2078
154.177.173.23:995
217.162.149.212:443
90.65.164.106:2222
46.53.16.201:443
98.121.4.98:443
78.101.234.58:443
100.12.74.21:995
176.181.247.197:443
87.115.120.176:2222
24.55.66.125:443
50.209.125.234:995
72.179.13.59:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1196 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1536 1212 WerFault.exe regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
regsvr32.exeWerFault.exepid process 1212 regsvr32.exe 1212 regsvr32.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1212 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1536 WerFault.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 1212 1808 regsvr32.exe regsvr32.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1648 1212 regsvr32.exe explorer.exe PID 1212 wrote to memory of 1536 1212 regsvr32.exe WerFault.exe PID 1212 wrote to memory of 1536 1212 regsvr32.exe WerFault.exe PID 1212 wrote to memory of 1536 1212 regsvr32.exe WerFault.exe PID 1212 wrote to memory of 1536 1212 regsvr32.exe WerFault.exe PID 1648 wrote to memory of 1692 1648 explorer.exe schtasks.exe PID 1648 wrote to memory of 1692 1648 explorer.exe schtasks.exe PID 1648 wrote to memory of 1692 1648 explorer.exe schtasks.exe PID 1648 wrote to memory of 1692 1648 explorer.exe schtasks.exe PID 1044 wrote to memory of 748 1044 taskeng.exe regsvr32.exe PID 1044 wrote to memory of 748 1044 taskeng.exe regsvr32.exe PID 1044 wrote to memory of 748 1044 taskeng.exe regsvr32.exe PID 1044 wrote to memory of 748 1044 taskeng.exe regsvr32.exe PID 1044 wrote to memory of 748 1044 taskeng.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe PID 748 wrote to memory of 1196 748 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kpyxbxm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll\"" /SC ONCE /Z /ST 15:16 /ET 15:284⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 3403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {3D149E63-FD40-42E6-9928-1FA48B83794B} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dllMD5
6e67d0a0cdd1598fd466f301a841ad0d
SHA14f8b5efc49b138d0b624412107fa4ca6e356b754
SHA256ae321153b31b5789658e43ece20dba63ab3c71fc8d233402b7165808aaee5f53
SHA51228a775549848b738343fe182f3ab6dd5e283b4486adee12ad5c7a96bc321e6fdb8500d94533452599438a3f442505fc1a804df52f1a5242fdaf7c23521d5bfee
-
\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dllMD5
6e67d0a0cdd1598fd466f301a841ad0d
SHA14f8b5efc49b138d0b624412107fa4ca6e356b754
SHA256ae321153b31b5789658e43ece20dba63ab3c71fc8d233402b7165808aaee5f53
SHA51228a775549848b738343fe182f3ab6dd5e283b4486adee12ad5c7a96bc321e6fdb8500d94533452599438a3f442505fc1a804df52f1a5242fdaf7c23521d5bfee
-
memory/748-12-0x0000000000000000-mapping.dmp
-
memory/1196-14-0x0000000000000000-mapping.dmp
-
memory/1212-8-0x0000000000000000-mapping.dmp
-
memory/1212-6-0x0000000000000000-mapping.dmp
-
memory/1212-7-0x0000000000000000-mapping.dmp
-
memory/1212-0-0x0000000000000000-mapping.dmp
-
memory/1212-2-0x0000000000AC0000-0x0000000000AE0000-memory.dmpFilesize
128KB
-
memory/1536-5-0x00000000020C0000-0x00000000020D1000-memory.dmpFilesize
68KB
-
memory/1536-9-0x0000000002830000-0x0000000002841000-memory.dmpFilesize
68KB
-
memory/1536-4-0x0000000000000000-mapping.dmp
-
memory/1648-11-0x0000000000080000-0x00000000000A0000-memory.dmpFilesize
128KB
-
memory/1648-3-0x0000000000000000-mapping.dmp
-
memory/1648-1-0x00000000000A0000-0x00000000000A2000-memory.dmpFilesize
8KB
-
memory/1692-10-0x0000000000000000-mapping.dmp