Analysis
-
max time kernel
128s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-12-2020 23:03
Behavioral task
behavioral1
Sample
md.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
md.dll
Resource
win10v20201028
General
-
Target
md.dll
-
Size
2.8MB
-
MD5
04416cf8bf1c7d31a606edff765529df
-
SHA1
bb6abc451db164e17a5dd030b355b309c219623d
-
SHA256
5094e17105845238a6a2aaf54cd6769733032009a9ddd24e8af046837c1c12e6
-
SHA512
348e86e7efa139f90fe71b751d476aa0ea6e83cc0cc37f9d18b4d9ebc0d37a47bafc4d911a603457bd6d36b7ed323520b11df06edb69605c961c721037628317
Malware Config
Extracted
qakbot
domain02
1606721866
106.51.52.111:443
2.88.53.159:995
89.33.87.107:443
185.105.131.233:443
175.137.119.141:443
197.161.154.132:443
39.32.125.15:995
217.133.54.140:32100
118.70.55.146:443
86.97.221.121:443
194.243.78.225:443
87.27.110.90:2222
196.151.252.84:443
5.15.30.56:443
85.121.42.12:443
90.23.117.67:2222
197.45.110.165:995
86.99.134.235:2222
59.96.165.120:443
174.76.21.134:443
208.99.100.129:443
86.126.198.195:443
80.106.85.24:2222
85.132.36.111:2222
105.198.236.101:443
2.49.219.254:22
83.196.50.197:2222
98.115.243.237:443
104.37.20.207:995
189.150.40.192:2222
200.75.136.78:443
72.183.129.56:443
92.154.83.96:2222
70.124.29.226:443
37.21.231.245:995
199.116.241.147:443
50.60.166.59:995
47.22.148.6:443
116.240.78.45:995
213.67.45.195:2222
73.166.10.38:995
94.52.160.116:443
47.44.217.98:443
73.51.245.231:995
174.29.203.226:993
178.222.114.132:995
173.197.22.90:2222
76.181.122.120:443
166.62.183.139:2078
108.160.123.244:443
207.255.18.67:443
47.208.8.187:443
85.60.132.8:2087
195.155.8.90:2222
122.59.40.31:443
71.126.139.251:443
84.78.128.76:2078
151.60.51.86:443
173.21.10.71:2222
172.114.116.226:995
96.20.108.17:2222
2.90.33.130:443
50.244.112.106:443
174.76.11.123:995
173.88.9.84:2222
72.29.181.78:2078
91.104.44.226:995
31.5.21.66:995
92.99.22.32:443
213.159.241.101:443
39.36.30.92:995
216.201.162.158:443
74.109.219.145:443
79.129.121.81:995
93.113.177.152:443
188.26.243.119:443
24.201.61.153:2078
80.227.5.70:443
81.133.234.36:2222
173.245.152.231:443
72.204.242.138:443
81.97.154.100:443
109.205.204.229:2222
120.150.218.241:995
24.55.66.125:443
41.39.134.183:443
80.14.22.234:2222
45.63.107.192:2222
149.28.98.196:443
45.63.107.192:995
149.28.98.196:995
149.28.98.196:2222
218.227.162.13:443
45.77.193.83:443
149.28.99.97:2222
94.49.188.240:443
149.28.99.97:443
144.139.47.206:443
176.45.233.94:995
83.110.19.27:443
72.36.59.46:2222
161.142.217.62:443
100.12.74.21:995
24.95.61.62:443
90.101.62.189:2222
24.122.0.90:443
219.76.148.249:443
73.248.120.240:443
2.89.183.206:443
37.116.152.122:2222
95.76.27.6:443
73.166.10.38:443
216.215.77.18:2078
37.210.133.63:995
81.214.126.173:2222
175.137.154.62:443
73.55.254.225:443
83.110.72.214:443
94.52.68.72:443
184.57.150.226:443
74.73.27.35:443
47.146.39.147:443
78.97.207.104:443
85.105.29.218:443
50.244.112.10:995
71.182.142.63:443
50.244.112.90:443
110.142.205.182:443
71.187.170.235:443
27.223.92.142:995
184.21.136.237:443
37.211.86.156:443
201.103.173.184:443
47.21.192.182:2222
96.225.88.23:443
74.134.184.114:443
93.149.253.201:2222
201.152.195.215:443
103.26.221.230:2222
93.146.133.102:2222
83.110.226.174:443
96.21.251.127:2222
86.98.10.63:2222
58.179.21.147:995
184.98.97.227:995
72.29.181.78:2222
180.233.150.134:443
2.50.3.98:443
83.110.158.124:2222
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 308 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1876 rundll32.exe 1876 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1876 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1876 1756 rundll32.exe rundll32.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1876 wrote to memory of 1360 1876 rundll32.exe explorer.exe PID 1360 wrote to memory of 316 1360 explorer.exe schtasks.exe PID 1360 wrote to memory of 316 1360 explorer.exe schtasks.exe PID 1360 wrote to memory of 316 1360 explorer.exe schtasks.exe PID 1360 wrote to memory of 316 1360 explorer.exe schtasks.exe PID 1752 wrote to memory of 940 1752 taskeng.exe regsvr32.exe PID 1752 wrote to memory of 940 1752 taskeng.exe regsvr32.exe PID 1752 wrote to memory of 940 1752 taskeng.exe regsvr32.exe PID 1752 wrote to memory of 940 1752 taskeng.exe regsvr32.exe PID 1752 wrote to memory of 940 1752 taskeng.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe PID 940 wrote to memory of 308 940 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\md.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\md.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yuiosjoeef /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\md.dll\"" /SC ONCE /Z /ST 23:09 /ET 23:214⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {32510ACF-93B4-46D5-9262-35DE36C4098F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\md.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\md.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\md.dllMD5
1a432a326b9f524ed074dc31c5fc69b2
SHA14a3b745cbe7a330e47899aae90572133692f2e89
SHA256f7b3fcb472ea7e17b2506080df874fdf8a212a5a59485b628a3787c61348b2e1
SHA512837da7d609c635b0a2b01b6377512f749d93a91860331ced46265b96a6c816233841a55f8bd0e0c0bf6ac28c814649b1f3fc91aa3420ae45dc3805a40e543c35
-
\Users\Admin\AppData\Local\Temp\md.dllMD5
1a432a326b9f524ed074dc31c5fc69b2
SHA14a3b745cbe7a330e47899aae90572133692f2e89
SHA256f7b3fcb472ea7e17b2506080df874fdf8a212a5a59485b628a3787c61348b2e1
SHA512837da7d609c635b0a2b01b6377512f749d93a91860331ced46265b96a6c816233841a55f8bd0e0c0bf6ac28c814649b1f3fc91aa3420ae45dc3805a40e543c35
-
memory/308-11-0x0000000000000000-mapping.dmp
-
memory/316-7-0x0000000000000000-mapping.dmp
-
memory/940-9-0x0000000000000000-mapping.dmp
-
memory/1360-3-0x00000000000A0000-0x00000000000A2000-memory.dmpFilesize
8KB
-
memory/1360-5-0x0000000000000000-mapping.dmp
-
memory/1360-8-0x0000000000080000-0x00000000000A0000-memory.dmpFilesize
128KB
-
memory/1876-2-0x0000000000000000-mapping.dmp
-
memory/1876-4-0x00000000001D0000-0x00000000001F0000-memory.dmpFilesize
128KB
-
memory/1876-6-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB