Analysis
-
max time kernel
128s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-02-2021 17:04
Static task
static1
Behavioral task
behavioral1
Sample
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll
Resource
win7v20201028
General
-
Target
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll
-
Size
773KB
-
MD5
900024080a53ea49f9f7cc6ef6a07d35
-
SHA1
323e4422e4df9606ca977a858dcd567d6ebd900c
-
SHA256
7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528
-
SHA512
55798f81d85ed788f55de739053e17dbbb3d5c44b3561c5477f1bad28a87f1629e0df7b48c6a076940ef876f2869ea08786678c696a100bf1587727908ffa1f1
Malware Config
Extracted
qakbot
tr
1612451251
176.205.222.30:2078
213.60.147.140:443
45.118.216.157:443
83.110.103.152:443
108.46.145.30:443
81.150.181.168:2222
24.229.150.54:995
45.77.115.208:2222
154.125.120.87:995
50.29.166.232:995
193.252.48.200:443
67.8.103.21:443
1.32.35.2:443
85.132.36.111:2222
197.51.82.72:443
173.17.117.83:443
45.63.107.192:443
82.76.47.211:443
149.28.99.97:995
144.202.38.185:2222
149.28.98.196:2222
144.202.38.185:995
149.28.101.90:443
149.28.101.90:995
45.32.211.207:995
207.246.116.237:8443
45.63.107.192:995
45.32.211.207:2222
45.32.211.207:8443
207.246.77.75:443
207.246.116.237:995
207.246.77.75:8443
149.28.98.196:995
45.63.107.192:2222
144.202.38.185:443
149.28.98.196:443
207.246.116.237:2222
149.28.99.97:443
207.246.77.75:995
207.246.116.237:443
149.28.101.90:8443
149.28.99.97:2222
149.28.101.90:2222
45.77.115.208:443
207.246.77.75:2222
173.21.10.71:2222
45.32.211.207:443
184.189.122.72:443
201.171.77.138:443
98.121.187.78:443
98.240.24.57:443
122.148.156.131:995
77.27.174.49:995
92.59.35.196:2222
45.77.115.208:995
45.77.115.208:8443
151.205.102.42:443
172.87.157.235:3389
83.110.12.140:2222
85.58.200.50:2222
86.236.77.68:2222
2.232.253.79:995
24.50.118.93:443
176.205.222.30:2222
95.77.223.148:443
84.247.55.190:8443
86.98.93.124:2078
151.33.233.193:443
70.126.76.75:443
172.78.30.215:443
119.157.118.42:3389
89.3.198.238:443
160.3.187.114:443
106.51.85.162:443
64.121.114.87:443
23.240.70.80:443
115.69.252.0:22
197.161.154.132:443
50.244.112.106:443
83.110.108.181:2222
105.198.236.99:443
140.82.49.12:443
188.25.63.105:443
181.48.190.78:443
80.11.173.82:8443
142.68.28.22:443
72.240.200.181:2222
71.88.193.17:443
103.51.20.143:2222
156.223.228.116:995
90.101.117.122:2222
81.97.154.100:443
78.63.226.32:443
68.186.192.69:443
86.220.60.133:2222
46.153.119.255:995
154.118.28.100:3389
67.6.12.4:443
88.226.163.213:443
78.97.207.104:443
217.128.247.208:2222
86.97.162.85:443
81.88.254.62:443
216.201.162.158:443
105.186.102.16:443
68.225.60.77:995
71.187.170.235:443
144.139.47.206:443
41.39.134.183:443
97.69.160.4:2222
81.214.126.173:2222
108.31.15.10:995
96.21.251.127:2222
203.194.110.74:443
2.50.2.216:443
209.210.187.52:995
193.248.221.184:2222
75.136.40.155:443
82.127.125.209:990
24.139.72.117:443
79.129.121.81:995
67.165.206.193:993
37.211.90.175:995
24.55.112.61:443
196.151.252.84:443
84.72.35.226:443
176.181.247.197:443
109.150.80.242:443
70.168.130.172:995
89.137.211.239:995
47.22.148.6:443
106.250.150.98:443
86.98.212.242:2222
80.11.5.65:2222
59.90.246.200:443
105.198.236.101:443
2.7.69.217:2222
71.74.12.34:443
217.165.22.188:443
125.63.101.62:443
154.177.89.164:443
202.187.58.21:443
202.184.20.119:443
39.57.147.20:995
171.103.138.122:995
77.31.46.230:443
115.133.243.6:443
42.115.200.16:443
189.222.139.243:443
27.223.92.142:995
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1376 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3228 1376 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
regsvr32.exeWerFault.exepid process 1424 regsvr32.exe 1424 regsvr32.exe 1424 regsvr32.exe 1424 regsvr32.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1424 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3228 WerFault.exe Token: SeBackupPrivilege 3228 WerFault.exe Token: SeDebugPrivilege 3228 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 492 wrote to memory of 1424 492 regsvr32.exe regsvr32.exe PID 492 wrote to memory of 1424 492 regsvr32.exe regsvr32.exe PID 492 wrote to memory of 1424 492 regsvr32.exe regsvr32.exe PID 1424 wrote to memory of 3904 1424 regsvr32.exe explorer.exe PID 1424 wrote to memory of 3904 1424 regsvr32.exe explorer.exe PID 1424 wrote to memory of 3904 1424 regsvr32.exe explorer.exe PID 1424 wrote to memory of 3904 1424 regsvr32.exe explorer.exe PID 1424 wrote to memory of 3904 1424 regsvr32.exe explorer.exe PID 3904 wrote to memory of 652 3904 explorer.exe schtasks.exe PID 3904 wrote to memory of 652 3904 explorer.exe schtasks.exe PID 3904 wrote to memory of 652 3904 explorer.exe schtasks.exe PID 3812 wrote to memory of 1376 3812 regsvr32.exe regsvr32.exe PID 3812 wrote to memory of 1376 3812 regsvr32.exe regsvr32.exe PID 3812 wrote to memory of 1376 3812 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hmdmuiubjj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll\"" /SC ONCE /Z /ST 17:12 /ET 17:244⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dllMD5
bc2392bccd6ca3bf066101fec0f0273d
SHA1c38ccacccf7e00c8d305d0dada49c1b7eaa13f6d
SHA25671328e11ca43c8b6674118e92cfb6e91e6cf44a6f405a6e2d174277e4e89ee8a
SHA51269a90106061014ef1921f0694939a43a0af19a73f02aa3ad87c902966417c0e16f3c223659c8fc770d6e58174517956c2d49119131a5c079b68812e0a5271ee9
-
\Users\Admin\AppData\Local\Temp\7b338c9afc864fa9b2cda3591c494e9ac81d0a4e54161ffa966a10005c634528.dllMD5
bc2392bccd6ca3bf066101fec0f0273d
SHA1c38ccacccf7e00c8d305d0dada49c1b7eaa13f6d
SHA25671328e11ca43c8b6674118e92cfb6e91e6cf44a6f405a6e2d174277e4e89ee8a
SHA51269a90106061014ef1921f0694939a43a0af19a73f02aa3ad87c902966417c0e16f3c223659c8fc770d6e58174517956c2d49119131a5c079b68812e0a5271ee9
-
memory/652-6-0x0000000000000000-mapping.dmp
-
memory/1376-10-0x0000000000000000-mapping.dmp
-
memory/1424-2-0x0000000000000000-mapping.dmp
-
memory/1424-3-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1424-4-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/3228-12-0x0000000003BA0000-0x0000000003BA1000-memory.dmpFilesize
4KB
-
memory/3904-5-0x0000000000000000-mapping.dmp
-
memory/3904-7-0x0000000002E30000-0x0000000002E65000-memory.dmpFilesize
212KB
-
memory/3904-8-0x0000000002E30000-0x0000000002E65000-memory.dmpFilesize
212KB