Analysis
-
max time kernel
132s -
max time network
104s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 16:18
Static task
static1
Behavioral task
behavioral1
Sample
cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll
Resource
win7v20201028
General
-
Target
cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll
-
Size
289KB
-
MD5
67ef5c7797e927b28bd49bdb72cca817
-
SHA1
d8cfb631d79c2c198dbd74345ae12b8d804dbfc3
-
SHA256
cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6
-
SHA512
e3d528872dfd9b24185f319a6137184025a5d3d4917a40a06332d11bf1a671a6d95504078786322e57eb05dc7e08449f8661ba8a2496a172e1740d514e35eed5
Malware Config
Extracted
qakbot
abc104
1606818862
79.119.124.237:443
87.218.53.206:2222
181.169.88.203:443
82.12.157.95:995
94.49.188.240:443
46.124.107.124:6881
86.122.248.164:2222
83.202.68.220:2222
79.129.216.215:2222
37.21.231.245:995
47.187.49.3:2222
2.90.33.130:443
149.28.98.196:995
149.28.99.97:443
45.63.107.192:995
149.28.98.196:2222
45.63.107.192:2222
74.73.27.35:443
149.28.98.196:443
144.202.38.185:2222
149.28.99.97:2222
45.77.193.83:443
144.202.38.185:995
24.95.61.62:443
95.77.223.148:443
71.187.170.235:443
39.36.30.92:995
188.26.243.119:443
78.187.125.116:2222
2.7.202.106:2222
178.80.62.24:443
91.104.44.226:995
81.214.126.173:2222
94.98.242.243:443
31.5.21.66:995
80.14.22.234:2222
98.121.187.78:443
47.44.217.98:443
82.10.43.130:2222
103.102.100.78:2222
45.118.65.34:443
176.45.233.94:995
81.247.148.252:995
211.24.72.253:443
189.231.3.63:443
41.227.76.249:443
156.222.155.185:995
75.136.40.155:443
92.154.83.96:2087
37.211.86.156:443
72.36.59.46:2222
219.76.148.249:443
2.50.56.81:443
47.21.192.182:2222
96.225.88.23:443
197.86.204.38:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
86.98.60.176:443
37.210.133.63:995
24.27.82.216:2222
82.127.125.209:20
79.115.171.106:2222
193.248.154.174:2222
172.78.30.215:443
79.166.96.86:2222
72.66.47.70:443
89.87.231.187:2222
72.29.181.78:2222
161.142.217.62:443
109.154.193.21:2222
86.245.87.251:2222
2.88.67.161:995
198.2.35.226:2222
83.110.206.115:995
2.89.183.206:443
151.16.241.219:443
110.142.205.182:443
85.98.177.32:443
78.181.19.134:443
102.185.242.27:443
90.101.117.122:2222
78.96.199.79:443
68.39.160.40:80
84.117.176.32:443
65.30.213.13:6882
42.201.228.106:995
80.195.103.146:2222
77.145.0.57:2222
94.59.236.155:995
1.43.86.247:2222
85.121.42.12:995
71.10.43.79:443
105.198.236.99:443
140.82.27.132:443
39.45.175.245:995
45.32.162.253:443
45.32.165.134:443
217.162.149.212:443
59.96.59.100:443
2.51.246.190:995
197.45.110.165:995
86.99.134.235:2222
24.179.13.119:443
176.181.247.197:443
68.131.19.52:443
86.98.34.84:995
184.21.136.237:995
65.131.47.74:995
185.105.131.233:443
81.133.234.36:2222
84.120.99.206:443
41.233.154.10:993
181.208.249.141:443
92.154.83.96:2222
92.154.83.96:1194
92.137.138.52:2222
175.140.23.200:443
46.177.174.186:443
203.106.195.67:443
172.87.157.235:443
121.58.199.24:443
151.60.163.18:443
73.51.245.231:995
37.210.131.246:443
151.27.89.199:443
41.237.210.179:995
94.69.112.148:2222
96.41.93.96:443
41.97.183.51:443
37.130.115.124:443
93.113.177.152:443
197.206.132.79:443
197.51.82.115:995
85.122.141.42:995
118.70.55.146:443
156.205.103.107:995
59.99.37.18:443
185.163.221.77:2222
39.32.55.12:995
62.38.114.12:2222
50.60.166.59:995
5.193.115.251:2222
58.152.9.133:443
196.151.252.84:443
120.151.95.167:443
178.222.114.132:995
97.119.234.37:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3700 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2072 3700 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
rundll32.exeWerFault.exepid process 1448 rundll32.exe 1448 rundll32.exe 1448 rundll32.exe 1448 rundll32.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1448 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2072 WerFault.exe Token: SeBackupPrivilege 2072 WerFault.exe Token: SeDebugPrivilege 2072 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exedescription pid process target process PID 1160 wrote to memory of 1448 1160 rundll32.exe rundll32.exe PID 1160 wrote to memory of 1448 1160 rundll32.exe rundll32.exe PID 1160 wrote to memory of 1448 1160 rundll32.exe rundll32.exe PID 1448 wrote to memory of 684 1448 rundll32.exe explorer.exe PID 1448 wrote to memory of 684 1448 rundll32.exe explorer.exe PID 1448 wrote to memory of 684 1448 rundll32.exe explorer.exe PID 1448 wrote to memory of 684 1448 rundll32.exe explorer.exe PID 1448 wrote to memory of 684 1448 rundll32.exe explorer.exe PID 684 wrote to memory of 372 684 explorer.exe schtasks.exe PID 684 wrote to memory of 372 684 explorer.exe schtasks.exe PID 684 wrote to memory of 372 684 explorer.exe schtasks.exe PID 3492 wrote to memory of 3700 3492 regsvr32.exe regsvr32.exe PID 3492 wrote to memory of 3700 3492 regsvr32.exe regsvr32.exe PID 3492 wrote to memory of 3700 3492 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn koxiltqwb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll\"" /SC ONCE /Z /ST 16:16 /ET 16:284⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dllMD5
2bf5d094d49fc849fdbcf58e580adb05
SHA13994a36a3c55998a9e16266792cc6bd85721b006
SHA2560bc51a8278b4dc539d8c937d075ecba4c65d10b9a1006d912bb8ac7e357a5d60
SHA512f422ba24a77c40a9033446b0b22876e0b5cd074d798274d762181306f31743a603a32edbadda57d913a7112fed73666fa62df4b6ddcdbc826cb897f81cfae73b
-
\Users\Admin\AppData\Local\Temp\cf065e980b8a901be9d0e1f52a50bcdc6c299850f4fb5b1ecfed6327a38c19b6.dllMD5
2bf5d094d49fc849fdbcf58e580adb05
SHA13994a36a3c55998a9e16266792cc6bd85721b006
SHA2560bc51a8278b4dc539d8c937d075ecba4c65d10b9a1006d912bb8ac7e357a5d60
SHA512f422ba24a77c40a9033446b0b22876e0b5cd074d798274d762181306f31743a603a32edbadda57d913a7112fed73666fa62df4b6ddcdbc826cb897f81cfae73b
-
memory/372-5-0x0000000000000000-mapping.dmp
-
memory/684-4-0x0000000000000000-mapping.dmp
-
memory/684-6-0x00000000008A0000-0x00000000008C1000-memory.dmpFilesize
132KB
-
memory/1448-2-0x0000000000000000-mapping.dmp
-
memory/1448-3-0x0000000003240000-0x0000000003261000-memory.dmpFilesize
132KB
-
memory/2072-10-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/3700-8-0x0000000000000000-mapping.dmp