Analysis
-
max time kernel
134s -
max time network
77s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-12-2020 21:04
Static task
static1
Behavioral task
behavioral1
Sample
Freyrgb.dll
Resource
win7v20201028
General
-
Target
Freyrgb.dll
-
Size
233KB
-
MD5
26d24454af322d1d22b36518af719583
-
SHA1
ce31d533625282273f0f8b310f35b72a58ba41f7
-
SHA256
18ddf0fc108a1840296cf1ab684ecb9fac48354130746e2d8cd67e8313a25f46
-
SHA512
5f68f027cc8ec92ad1e9bb9f4a386b64f19a4c3d961bbd6bae85e3c28ba6f22734a5fcecba476d4196b80f2f2128f7a4d2df3eaa65232611ca9b22512a9242c2
Malware Config
Extracted
qakbot
tr02
1606748059
197.45.110.165:995
86.99.134.235:2222
174.76.21.134:443
208.99.100.129:443
86.126.198.195:443
185.105.131.233:443
85.132.36.111:2222
105.198.236.101:443
2.49.219.254:22
217.165.2.92:995
67.6.54.180:443
5.193.115.251:2222
83.196.50.197:2222
89.3.198.238:443
94.141.3.242:443
73.239.229.107:995
217.165.15.245:2222
68.225.60.77:995
85.121.42.12:443
99.240.226.2:443
98.4.227.199:443
85.186.122.190:443
41.205.16.108:443
187.213.199.54:443
189.250.59.212:2222
106.51.52.111:443
2.88.53.159:995
208.93.202.41:443
151.27.89.199:443
92.137.138.52:2222
173.70.165.101:995
89.33.87.107:443
108.46.145.30:443
118.160.162.127:443
187.213.136.249:995
94.53.92.42:443
80.106.85.24:2222
197.161.154.132:443
172.87.134.226:443
79.129.121.81:995
217.133.54.140:32100
67.8.103.21:443
74.135.112.78:443
118.70.55.146:443
86.97.221.121:443
87.27.110.90:2222
72.240.200.181:2222
196.151.252.84:443
209.137.209.158:443
94.49.157.35:443
67.61.157.208:443
151.60.163.18:443
47.44.217.98:443
73.51.245.231:995
174.29.203.226:993
178.222.114.132:995
83.110.19.27:443
156.213.155.74:443
98.115.243.237:443
83.202.68.220:2222
86.162.13.35:2222
109.115.125.81:50000
189.150.40.192:2222
200.75.136.78:443
92.154.83.96:2222
72.183.129.56:443
78.182.229.145:20
80.11.5.65:2222
85.204.189.105:443
189.141.31.12:443
81.97.154.100:443
199.116.241.147:443
206.183.190.53:993
50.60.166.59:995
47.22.148.6:443
116.240.78.45:995
75.109.180.221:443
213.67.45.195:2222
73.166.10.38:995
144.202.38.185:2222
144.202.38.185:995
90.101.117.122:2222
75.136.26.147:443
120.150.218.241:995
24.55.66.125:443
80.14.22.234:2222
94.49.188.240:443
173.197.22.90:2222
76.181.122.120:443
166.62.183.139:2078
72.36.59.46:2222
108.160.123.244:443
95.77.144.238:443
79.115.171.106:2222
78.181.19.134:443
41.105.41.202:443
85.60.132.8:2087
71.126.139.251:443
80.227.5.70:443
197.86.204.38:443
172.114.116.226:995
96.20.108.17:2222
2.90.33.130:443
50.244.112.106:443
174.76.11.123:995
185.126.13.190:995
72.29.181.78:2078
86.96.87.59:2078
91.104.44.226:995
173.245.152.231:443
92.99.22.32:443
39.36.30.92:995
216.201.162.158:443
173.169.189.169:443
93.113.177.152:443
108.190.151.108:2222
188.26.243.119:443
24.201.61.153:2078
149.28.99.97:2222
45.77.193.83:443
149.28.99.97:443
81.133.234.36:2222
95.76.27.6:443
72.204.242.138:443
69.123.234.175:443
45.63.107.192:2222
45.63.107.192:995
149.28.98.196:2222
149.28.98.196:995
149.28.98.196:443
109.205.204.229:2222
47.146.39.147:443
85.105.29.218:443
50.244.112.10:995
71.182.142.63:443
50.244.112.90:443
144.139.47.206:443
92.154.83.96:1194
176.45.233.94:995
86.245.87.251:2222
73.55.254.225:443
41.228.34.92:443
2.50.2.216:443
77.27.174.49:995
72.28.255.159:995
105.96.27.117:443
24.27.82.216:2222
100.12.74.21:995
95.77.223.148:443
24.95.61.62:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3980 regsvr32.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2328 1640 WerFault.exe regsvr32.exe 3948 3980 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
regsvr32.exeWerFault.exeWerFault.exepid process 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1640 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2328 WerFault.exe Token: SeBackupPrivilege 2328 WerFault.exe Token: SeDebugPrivilege 2328 WerFault.exe Token: SeDebugPrivilege 3948 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 640 wrote to memory of 1640 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 1640 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 1640 640 regsvr32.exe regsvr32.exe PID 1640 wrote to memory of 3376 1640 regsvr32.exe explorer.exe PID 1640 wrote to memory of 3376 1640 regsvr32.exe explorer.exe PID 1640 wrote to memory of 3376 1640 regsvr32.exe explorer.exe PID 1640 wrote to memory of 3376 1640 regsvr32.exe explorer.exe PID 1640 wrote to memory of 3376 1640 regsvr32.exe explorer.exe PID 3376 wrote to memory of 940 3376 explorer.exe schtasks.exe PID 3376 wrote to memory of 940 3376 explorer.exe schtasks.exe PID 3376 wrote to memory of 940 3376 explorer.exe schtasks.exe PID 2704 wrote to memory of 3980 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 3980 2704 regsvr32.exe regsvr32.exe PID 2704 wrote to memory of 3980 2704 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Freyrgb.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\Freyrgb.dll2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kuyludrcxr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Freyrgb.dll\"" /SC ONCE /Z /ST 22:03 /ET 22:154⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 5883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Freyrgb.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\Freyrgb.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Freyrgb.dllMD5
bd6807cfd8c30771a399c87fea70703a
SHA18381df96c2e97f897141846adf0b9330856a4cda
SHA256fc2b954633ff323e7ce17da29ba1c89bb5fbe368534b7c956a3ea2e534b87e17
SHA5128efe20347d6d19f89eb7f1e91003c0c39f655edea442287cf3694711b4b306c9baa589de706833acd995d5dcaac7be303e5f8519163411bab2f282b5f065fcef
-
\Users\Admin\AppData\Local\Temp\Freyrgb.dllMD5
bd6807cfd8c30771a399c87fea70703a
SHA18381df96c2e97f897141846adf0b9330856a4cda
SHA256fc2b954633ff323e7ce17da29ba1c89bb5fbe368534b7c956a3ea2e534b87e17
SHA5128efe20347d6d19f89eb7f1e91003c0c39f655edea442287cf3694711b4b306c9baa589de706833acd995d5dcaac7be303e5f8519163411bab2f282b5f065fcef
-
memory/940-5-0x0000000000000000-mapping.dmp
-
memory/1640-3-0x0000000001320000-0x0000000001340000-memory.dmpFilesize
128KB
-
memory/1640-2-0x0000000000000000-mapping.dmp
-
memory/1640-8-0x0000000000000000-mapping.dmp
-
memory/1640-9-0x0000000000000000-mapping.dmp
-
memory/1640-10-0x0000000000000000-mapping.dmp
-
memory/1640-11-0x0000000000000000-mapping.dmp
-
memory/2328-7-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/2328-12-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/3376-6-0x0000000002790000-0x00000000027B0000-memory.dmpFilesize
128KB
-
memory/3376-4-0x0000000000000000-mapping.dmp
-
memory/3948-16-0x0000000002EA0000-0x0000000002EA1000-memory.dmpFilesize
4KB
-
memory/3948-18-0x0000000003610000-0x0000000003611000-memory.dmpFilesize
4KB
-
memory/3980-14-0x0000000000000000-mapping.dmp
-
memory/3980-17-0x0000000000000000-mapping.dmp