Analysis
-
max time kernel
128s -
max time network
32s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-02-2021 17:04
Static task
static1
Behavioral task
behavioral1
Sample
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll
Resource
win7v20201028
General
-
Target
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll
-
Size
773KB
-
MD5
900024080a53ea49f9f7cc6ef6a07d35
-
SHA1
323e4422e4df9606ca977a858dcd567d6ebd900c
-
SHA256
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528
-
SHA512
55798f81d85ed788f55de739053e17dbbb3d5c44b3561c5477f1bad28a87f1629e0df7b48c6a076940ef876f2869ea08786678c696a100bf1587727908ffa1f1
Malware Config
Extracted
qakbot
tr
1612451251
176.205.222.30:2078
213.60.147.140:443
45.118.216.157:443
83.110.103.152:443
108.46.145.30:443
81.150.181.168:2222
24.229.150.54:995
45.77.115.208:2222
154.125.120.87:995
50.29.166.232:995
193.252.48.200:443
67.8.103.21:443
1.32.35.2:443
85.132.36.111:2222
197.51.82.72:443
173.17.117.83:443
45.63.107.192:443
82.76.47.211:443
149.28.99.97:995
144.202.38.185:2222
149.28.98.196:2222
144.202.38.185:995
149.28.101.90:443
149.28.101.90:995
45.32.211.207:995
207.246.116.237:8443
45.63.107.192:995
45.32.211.207:2222
45.32.211.207:8443
207.246.77.75:443
207.246.116.237:995
207.246.77.75:8443
149.28.98.196:995
45.63.107.192:2222
144.202.38.185:443
149.28.98.196:443
207.246.116.237:2222
149.28.99.97:443
207.246.77.75:995
207.246.116.237:443
149.28.101.90:8443
149.28.99.97:2222
149.28.101.90:2222
45.77.115.208:443
207.246.77.75:2222
173.21.10.71:2222
45.32.211.207:443
184.189.122.72:443
201.171.77.138:443
98.121.187.78:443
98.240.24.57:443
122.148.156.131:995
77.27.174.49:995
92.59.35.196:2222
45.77.115.208:995
45.77.115.208:8443
151.205.102.42:443
172.87.157.235:3389
83.110.12.140:2222
85.58.200.50:2222
86.236.77.68:2222
2.232.253.79:995
24.50.118.93:443
176.205.222.30:2222
95.77.223.148:443
84.247.55.190:8443
86.98.93.124:2078
151.33.233.193:443
70.126.76.75:443
172.78.30.215:443
119.157.118.42:3389
89.3.198.238:443
160.3.187.114:443
106.51.85.162:443
64.121.114.87:443
23.240.70.80:443
115.69.252.0:22
197.161.154.132:443
50.244.112.106:443
83.110.108.181:2222
105.198.236.99:443
140.82.49.12:443
188.25.63.105:443
181.48.190.78:443
80.11.173.82:8443
142.68.28.22:443
72.240.200.181:2222
71.88.193.17:443
103.51.20.143:2222
156.223.228.116:995
90.101.117.122:2222
81.97.154.100:443
78.63.226.32:443
68.186.192.69:443
86.220.60.133:2222
46.153.119.255:995
154.118.28.100:3389
67.6.12.4:443
88.226.163.213:443
78.97.207.104:443
217.128.247.208:2222
86.97.162.85:443
81.88.254.62:443
216.201.162.158:443
105.186.102.16:443
68.225.60.77:995
71.187.170.235:443
144.139.47.206:443
41.39.134.183:443
97.69.160.4:2222
81.214.126.173:2222
108.31.15.10:995
96.21.251.127:2222
203.194.110.74:443
2.50.2.216:443
209.210.187.52:995
193.248.221.184:2222
75.136.40.155:443
82.127.125.209:990
24.139.72.117:443
79.129.121.81:995
67.165.206.193:993
37.211.90.175:995
24.55.112.61:443
196.151.252.84:443
84.72.35.226:443
176.181.247.197:443
109.150.80.242:443
70.168.130.172:995
89.137.211.239:995
47.22.148.6:443
106.250.150.98:443
86.98.212.242:2222
80.11.5.65:2222
59.90.246.200:443
105.198.236.101:443
2.7.69.217:2222
71.74.12.34:443
217.165.22.188:443
125.63.101.62:443
154.177.89.164:443
202.187.58.21:443
202.184.20.119:443
39.57.147.20:995
171.103.138.122:995
77.31.46.230:443
115.133.243.6:443
42.115.200.16:443
189.222.139.243:443
27.223.92.142:995
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1076 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1588 regsvr32.exe 1588 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1588 regsvr32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1588 2044 regsvr32.exe regsvr32.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1588 wrote to memory of 1616 1588 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1660 1616 explorer.exe schtasks.exe PID 1616 wrote to memory of 1660 1616 explorer.exe schtasks.exe PID 1616 wrote to memory of 1660 1616 explorer.exe schtasks.exe PID 1616 wrote to memory of 1660 1616 explorer.exe schtasks.exe PID 956 wrote to memory of 916 956 taskeng.exe regsvr32.exe PID 956 wrote to memory of 916 956 taskeng.exe regsvr32.exe PID 956 wrote to memory of 916 956 taskeng.exe regsvr32.exe PID 956 wrote to memory of 916 956 taskeng.exe regsvr32.exe PID 956 wrote to memory of 916 956 taskeng.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe PID 916 wrote to memory of 1076 916 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn erxscnlne /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll\"" /SC ONCE /Z /ST 17:12 /ET 17:244⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C5DB33EE-7E1A-4FEC-B301-43F5E85CB54A} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dllMD5
bc2392bccd6ca3bf066101fec0f0273d
SHA1c38ccacccf7e00c8d305d0dada49c1b7eaa13f6d
SHA25671328e11ca43c8b6674118e92cfb6e91e6cf44a6f405a6e2d174277e4e89ee8a
SHA51269a90106061014ef1921f0694939a43a0af19a73f02aa3ad87c902966417c0e16f3c223659c8fc770d6e58174517956c2d49119131a5c079b68812e0a5271ee9
-
\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dllMD5
bc2392bccd6ca3bf066101fec0f0273d
SHA1c38ccacccf7e00c8d305d0dada49c1b7eaa13f6d
SHA25671328e11ca43c8b6674118e92cfb6e91e6cf44a6f405a6e2d174277e4e89ee8a
SHA51269a90106061014ef1921f0694939a43a0af19a73f02aa3ad87c902966417c0e16f3c223659c8fc770d6e58174517956c2d49119131a5c079b68812e0a5271ee9
-
memory/916-13-0x0000000000000000-mapping.dmp
-
memory/1076-16-0x0000000000000000-mapping.dmp
-
memory/1588-3-0x0000000000000000-mapping.dmp
-
memory/1588-4-0x0000000075251000-0x0000000075253000-memory.dmpFilesize
8KB
-
memory/1588-6-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1588-5-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1616-9-0x00000000747B1000-0x00000000747B3000-memory.dmpFilesize
8KB
-
memory/1616-12-0x00000000000F0000-0x0000000000125000-memory.dmpFilesize
212KB
-
memory/1616-11-0x00000000000F0000-0x0000000000125000-memory.dmpFilesize
212KB
-
memory/1616-7-0x0000000000000000-mapping.dmp
-
memory/1660-10-0x0000000000000000-mapping.dmp
-
memory/2044-2-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB