Analysis
-
max time kernel
129s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-12-2020 16:38
Static task
static1
Behavioral task
behavioral1
Sample
894423f39835051eafd433c4d0f726f3db172520.dll
Resource
win7v20201028
General
-
Target
894423f39835051eafd433c4d0f726f3db172520.dll
-
Size
2.0MB
-
MD5
b2a9a4e1656bdb5749de4f228dc9f307
-
SHA1
894423f39835051eafd433c4d0f726f3db172520
-
SHA256
3984b1072731ae1a7e6f83b76e1fbbca09e0f2968d06087f2579e22edb56edc2
-
SHA512
74b73e5afdb0ccf701a1d877e1381b1b7b6fa4a81a3b06e6021169ebb3ba936ec01c2b148aa3ee5c2344ae40c349edd0188dd85e2c874dc7f6adbc841e0768af
Malware Config
Extracted
qakbot
tr02
1607955641
120.151.95.167:443
47.44.217.98:443
32.212.117.188:443
184.97.145.239:443
86.121.3.80:443
83.110.97.149:443
83.194.193.247:2222
105.198.236.101:443
35.134.202.234:443
189.62.175.92:22
2.89.122.157:443
78.97.207.104:443
208.93.202.41:443
45.118.216.157:443
5.204.148.208:995
5.15.226.81:443
66.26.160.37:443
84.78.128.76:2222
80.106.85.24:2222
108.31.15.10:995
67.6.54.180:443
70.118.146.154:995
98.16.204.189:995
5.15.109.245:443
50.244.112.10:995
96.27.47.70:2222
47.146.34.236:443
45.77.115.208:443
24.95.61.62:443
37.107.76.36:995
78.63.226.32:443
77.27.174.49:995
149.135.101.20:443
87.238.133.190:995
58.179.21.147:995
103.110.6.151:2087
197.161.154.132:443
200.38.254.177:443
67.249.12.146:443
83.110.78.194:443
85.122.5.98:443
83.110.109.78:2222
181.48.190.78:443
108.190.151.108:2222
190.220.8.10:995
78.187.125.116:2222
197.135.246.41:443
51.235.149.29:443
65.30.213.13:6882
105.184.50.206:443
24.229.150.54:995
24.234.204.230:995
80.14.22.234:2222
74.222.204.82:995
82.76.47.211:443
206.183.190.53:993
109.205.204.229:2222
191.84.8.167:443
200.44.237.189:2222
80.195.103.146:2222
198.2.35.226:2222
86.121.41.112:443
92.154.83.96:1194
66.25.168.167:2222
154.238.37.26:995
75.109.180.221:995
85.132.36.111:2222
156.213.217.254:443
217.128.117.218:2222
108.30.125.94:443
122.148.156.131:995
76.167.240.21:443
5.193.106.230:2078
120.57.72.44:443
103.102.100.78:2222
2.50.88.125:995
149.28.99.97:443
45.77.115.208:995
149.28.101.90:995
149.28.98.196:443
85.105.29.218:443
144.202.38.185:2222
144.202.38.185:443
86.98.21.136:443
2.50.2.146:995
45.63.107.192:995
149.28.98.196:2222
149.28.98.196:995
116.240.76.97:0
84.232.252.202:2222
45.63.107.192:443
149.28.101.90:2222
144.202.38.185:995
149.28.99.97:2222
45.63.107.192:2222
149.28.99.97:995
85.101.187.146:443
51.223.138.251:443
71.117.132.169:443
90.201.21.58:443
81.214.126.173:2222
84.117.176.32:443
78.181.19.134:443
92.154.83.96:2078
71.58.19.33:443
47.22.148.6:995
86.245.82.249:2078
92.154.83.96:2087
197.49.240.8:995
95.76.27.6:443
116.240.78.45:995
140.82.49.12:443
201.152.69.198:995
160.3.184.253:443
24.139.72.117:443
47.22.148.6:443
197.82.221.199:443
174.62.13.151:443
186.29.96.147:443
79.129.252.62:2222
2.50.2.216:443
200.30.223.162:443
105.99.18.189:443
90.101.117.122:2222
102.187.59.94:443
151.60.38.21:443
185.163.221.77:2222
105.199.235.142:443
102.185.13.89:443
189.183.209.65:443
92.59.35.196:2083
86.122.248.164:2222
151.73.121.136:443
93.148.241.179:2222
105.198.236.99:443
134.228.24.29:443
46.53.0.32:443
178.191.126.94:993
2.50.57.224:443
184.98.97.227:995
80.11.5.65:2222
185.138.132.186:443
24.179.13.119:443
47.138.204.19:443
74.73.27.35:443
125.63.101.62:443
59.96.58.232:443
95.77.144.238:443
37.130.115.124:443
216.201.162.158:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1084 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1768 rundll32.exe 1768 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1768 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1432 wrote to memory of 1768 1432 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1768 wrote to memory of 1968 1768 rundll32.exe explorer.exe PID 1968 wrote to memory of 1928 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1928 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1928 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1928 1968 explorer.exe schtasks.exe PID 1176 wrote to memory of 1040 1176 taskeng.exe regsvr32.exe PID 1176 wrote to memory of 1040 1176 taskeng.exe regsvr32.exe PID 1176 wrote to memory of 1040 1176 taskeng.exe regsvr32.exe PID 1176 wrote to memory of 1040 1176 taskeng.exe regsvr32.exe PID 1176 wrote to memory of 1040 1176 taskeng.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe PID 1040 wrote to memory of 1084 1040 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xtdtdflbr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll\"" /SC ONCE /Z /ST 16:37 /ET 16:494⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {90C43C14-E420-421B-8BBA-47B0C8E64E0F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dllMD5
cbbbd93f6d56beb2083844c7da7b2982
SHA19ad1c6566fc917f1161951eca89bcd2706b41b71
SHA25608b593884c460b03404122a22a9029e3e5beb2103acc64d1be445856740ce0c5
SHA512e067a11629634176182c76fc8c3ceb149f939d892110b4eff17bc3c8ce2652729deb6c0a384971906decb2ff1343554384b45461bf578d92bb19a53426873aa0
-
\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dllMD5
cbbbd93f6d56beb2083844c7da7b2982
SHA19ad1c6566fc917f1161951eca89bcd2706b41b71
SHA25608b593884c460b03404122a22a9029e3e5beb2103acc64d1be445856740ce0c5
SHA512e067a11629634176182c76fc8c3ceb149f939d892110b4eff17bc3c8ce2652729deb6c0a384971906decb2ff1343554384b45461bf578d92bb19a53426873aa0
-
memory/1040-9-0x0000000000000000-mapping.dmp
-
memory/1084-11-0x0000000000000000-mapping.dmp
-
memory/1768-2-0x0000000000000000-mapping.dmp
-
memory/1768-4-0x00000000001F0000-0x0000000000211000-memory.dmpFilesize
132KB
-
memory/1768-6-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/1928-7-0x0000000000000000-mapping.dmp
-
memory/1968-3-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1968-5-0x0000000000000000-mapping.dmp
-
memory/1968-8-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB