Analysis
-
max time kernel
148s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-12-2020 16:38
Static task
static1
Behavioral task
behavioral1
Sample
894423f39835051eafd433c4d0f726f3db172520.dll
Resource
win7v20201028
General
-
Target
894423f39835051eafd433c4d0f726f3db172520.dll
-
Size
2.0MB
-
MD5
b2a9a4e1656bdb5749de4f228dc9f307
-
SHA1
894423f39835051eafd433c4d0f726f3db172520
-
SHA256
3984b1072731ae1a7e6f83b76e1fbbca09e0f2968d06087f2579e22edb56edc2
-
SHA512
74b73e5afdb0ccf701a1d877e1381b1b7b6fa4a81a3b06e6021169ebb3ba936ec01c2b148aa3ee5c2344ae40c349edd0188dd85e2c874dc7f6adbc841e0768af
Malware Config
Extracted
qakbot
tr02
1607955641
120.151.95.167:443
47.44.217.98:443
32.212.117.188:443
184.97.145.239:443
86.121.3.80:443
83.110.97.149:443
83.194.193.247:2222
105.198.236.101:443
35.134.202.234:443
189.62.175.92:22
2.89.122.157:443
78.97.207.104:443
208.93.202.41:443
45.118.216.157:443
5.204.148.208:995
5.15.226.81:443
66.26.160.37:443
84.78.128.76:2222
80.106.85.24:2222
108.31.15.10:995
67.6.54.180:443
70.118.146.154:995
98.16.204.189:995
5.15.109.245:443
50.244.112.10:995
96.27.47.70:2222
47.146.34.236:443
45.77.115.208:443
24.95.61.62:443
37.107.76.36:995
78.63.226.32:443
77.27.174.49:995
149.135.101.20:443
87.238.133.190:995
58.179.21.147:995
103.110.6.151:2087
197.161.154.132:443
200.38.254.177:443
67.249.12.146:443
83.110.78.194:443
85.122.5.98:443
83.110.109.78:2222
181.48.190.78:443
108.190.151.108:2222
190.220.8.10:995
78.187.125.116:2222
197.135.246.41:443
51.235.149.29:443
65.30.213.13:6882
105.184.50.206:443
24.229.150.54:995
24.234.204.230:995
80.14.22.234:2222
74.222.204.82:995
82.76.47.211:443
206.183.190.53:993
109.205.204.229:2222
191.84.8.167:443
200.44.237.189:2222
80.195.103.146:2222
198.2.35.226:2222
86.121.41.112:443
92.154.83.96:1194
66.25.168.167:2222
154.238.37.26:995
75.109.180.221:995
85.132.36.111:2222
156.213.217.254:443
217.128.117.218:2222
108.30.125.94:443
122.148.156.131:995
76.167.240.21:443
5.193.106.230:2078
120.57.72.44:443
103.102.100.78:2222
2.50.88.125:995
149.28.99.97:443
45.77.115.208:995
149.28.101.90:995
149.28.98.196:443
85.105.29.218:443
144.202.38.185:2222
144.202.38.185:443
86.98.21.136:443
2.50.2.146:995
45.63.107.192:995
149.28.98.196:2222
149.28.98.196:995
116.240.76.97:0
84.232.252.202:2222
45.63.107.192:443
149.28.101.90:2222
144.202.38.185:995
149.28.99.97:2222
45.63.107.192:2222
149.28.99.97:995
85.101.187.146:443
51.223.138.251:443
71.117.132.169:443
90.201.21.58:443
81.214.126.173:2222
84.117.176.32:443
78.181.19.134:443
92.154.83.96:2078
71.58.19.33:443
47.22.148.6:995
86.245.82.249:2078
92.154.83.96:2087
197.49.240.8:995
95.76.27.6:443
116.240.78.45:995
140.82.49.12:443
201.152.69.198:995
160.3.184.253:443
24.139.72.117:443
47.22.148.6:443
197.82.221.199:443
174.62.13.151:443
186.29.96.147:443
79.129.252.62:2222
2.50.2.216:443
200.30.223.162:443
105.99.18.189:443
90.101.117.122:2222
102.187.59.94:443
151.60.38.21:443
185.163.221.77:2222
105.199.235.142:443
102.185.13.89:443
189.183.209.65:443
92.59.35.196:2083
86.122.248.164:2222
151.73.121.136:443
93.148.241.179:2222
105.198.236.99:443
134.228.24.29:443
46.53.0.32:443
178.191.126.94:993
2.50.57.224:443
184.98.97.227:995
80.11.5.65:2222
185.138.132.186:443
24.179.13.119:443
47.138.204.19:443
74.73.27.35:443
125.63.101.62:443
59.96.58.232:443
95.77.144.238:443
37.130.115.124:443
216.201.162.158:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1368 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1556 1368 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
rundll32.exeWerFault.exepid process 3980 rundll32.exe 3980 rundll32.exe 3980 rundll32.exe 3980 rundll32.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe 1556 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 3980 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1556 WerFault.exe Token: SeBackupPrivilege 1556 WerFault.exe Token: SeDebugPrivilege 1556 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exedescription pid process target process PID 1048 wrote to memory of 3980 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 3980 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 3980 1048 rundll32.exe rundll32.exe PID 3980 wrote to memory of 1044 3980 rundll32.exe explorer.exe PID 3980 wrote to memory of 1044 3980 rundll32.exe explorer.exe PID 3980 wrote to memory of 1044 3980 rundll32.exe explorer.exe PID 3980 wrote to memory of 1044 3980 rundll32.exe explorer.exe PID 3980 wrote to memory of 1044 3980 rundll32.exe explorer.exe PID 1044 wrote to memory of 1524 1044 explorer.exe schtasks.exe PID 1044 wrote to memory of 1524 1044 explorer.exe schtasks.exe PID 1044 wrote to memory of 1524 1044 explorer.exe schtasks.exe PID 3928 wrote to memory of 1368 3928 regsvr32.exe regsvr32.exe PID 3928 wrote to memory of 1368 3928 regsvr32.exe regsvr32.exe PID 3928 wrote to memory of 1368 3928 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bcozmwmhbb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll\"" /SC ONCE /Z /ST 17:44 /ET 17:564⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dllMD5
cbbbd93f6d56beb2083844c7da7b2982
SHA19ad1c6566fc917f1161951eca89bcd2706b41b71
SHA25608b593884c460b03404122a22a9029e3e5beb2103acc64d1be445856740ce0c5
SHA512e067a11629634176182c76fc8c3ceb149f939d892110b4eff17bc3c8ce2652729deb6c0a384971906decb2ff1343554384b45461bf578d92bb19a53426873aa0
-
\Users\Admin\AppData\Local\Temp\894423f39835051eafd433c4d0f726f3db172520.dllMD5
cbbbd93f6d56beb2083844c7da7b2982
SHA19ad1c6566fc917f1161951eca89bcd2706b41b71
SHA25608b593884c460b03404122a22a9029e3e5beb2103acc64d1be445856740ce0c5
SHA512e067a11629634176182c76fc8c3ceb149f939d892110b4eff17bc3c8ce2652729deb6c0a384971906decb2ff1343554384b45461bf578d92bb19a53426873aa0
-
memory/1044-4-0x0000000000000000-mapping.dmp
-
memory/1044-7-0x0000000003090000-0x00000000030B1000-memory.dmpFilesize
132KB
-
memory/1368-9-0x0000000000000000-mapping.dmp
-
memory/1368-12-0x0000000000000000-mapping.dmp
-
memory/1524-6-0x0000000000000000-mapping.dmp
-
memory/1556-11-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/1556-13-0x00000000039A0000-0x00000000039A1000-memory.dmpFilesize
4KB
-
memory/3980-2-0x0000000000000000-mapping.dmp
-
memory/3980-3-0x0000000002D70000-0x0000000002D91000-memory.dmpFilesize
132KB
-
memory/3980-5-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB