Analysis
-
max time kernel
129s -
max time network
104s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-02-2021 22:47
Static task
static1
Behavioral task
behavioral1
Sample
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll
Resource
win7v20201028
General
-
Target
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll
-
Size
617KB
-
MD5
5e3749f332a005fadc0667375f8c6d19
-
SHA1
9271eb55dfe65239f20c6d6ac0f313a5f4fd54ff
-
SHA256
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5
-
SHA512
ffcd6a8ce211ffa5175e066657490649d585ca8ec7b0606d92a34041740ef3d48b262cda9f960e41e4ccd3b32a48d3fbbdd519c68365c9b6fc5e778e8c1c04ef
Malware Config
Extracted
qakbot
tr
1612175155
89.3.198.238:443
172.78.30.215:443
85.52.72.32:2222
76.110.113.71:995
106.51.52.111:443
75.67.192.125:443
172.115.177.204:2222
197.45.110.165:995
82.76.47.211:443
45.77.115.208:443
45.32.211.207:443
144.202.38.185:443
207.246.116.237:995
149.28.101.90:995
149.28.101.90:8443
207.246.116.237:8443
144.202.38.185:2222
45.32.211.207:8443
149.28.101.90:443
149.28.101.90:2222
207.246.116.237:443
207.246.77.75:995
149.28.98.196:2222
149.28.99.97:443
149.28.99.97:995
149.28.99.97:2222
45.63.107.192:2222
45.63.107.192:443
144.202.38.185:995
45.32.211.207:2222
207.246.116.237:2222
207.246.77.75:2222
207.246.77.75:443
45.77.115.208:2222
207.246.77.75:8443
149.28.98.196:995
149.28.98.196:443
45.63.107.192:995
45.32.211.207:995
184.189.122.72:443
80.227.5.69:443
175.141.219.71:443
202.188.138.162:443
77.27.174.49:995
92.59.35.196:2222
81.97.154.100:443
45.77.115.208:995
45.77.115.208:8443
85.58.200.50:2222
86.97.8.63:443
50.240.77.238:22
203.198.96.37:443
24.50.118.93:443
190.85.91.154:443
176.181.247.197:443
41.205.16.1:443
78.63.226.32:443
184.179.14.130:22
193.248.221.184:2222
82.12.157.95:995
172.87.157.235:3389
51.9.198.164:2222
151.242.62.59:32103
70.126.76.75:443
160.3.187.114:443
69.58.147.82:2078
64.121.114.87:443
50.244.112.106:443
76.25.142.196:443
188.25.63.105:443
2.50.2.216:443
80.11.173.82:8443
83.110.103.152:443
140.82.49.12:443
84.72.35.226:443
71.88.193.17:443
74.77.162.33:443
68.186.192.69:443
46.153.119.255:995
213.60.147.140:443
216.201.162.158:443
81.88.254.62:443
196.151.252.84:443
105.186.102.16:443
71.187.170.235:443
68.225.60.77:995
95.77.223.148:443
105.198.236.101:443
81.214.126.173:2222
83.110.108.181:2222
202.184.20.119:443
83.110.12.140:2222
75.136.40.155:443
79.129.121.81:995
37.211.90.175:995
80.11.5.65:2222
85.132.36.111:2222
90.101.117.122:2222
105.96.8.96:443
86.236.77.68:2222
151.33.227.106:443
197.161.154.132:443
115.133.243.6:443
86.98.93.124:2078
156.223.24.221:443
50.29.166.232:995
2.232.253.79:995
2.7.69.217:2222
106.250.150.98:443
47.22.148.6:443
68.131.107.37:443
173.21.10.71:2222
31.5.21.66:995
78.182.229.147:443
69.123.179.70:443
75.118.1.141:443
144.139.47.206:443
45.46.53.140:2222
70.54.25.76:2222
75.136.26.147:443
144.139.166.18:443
67.6.12.4:443
76.111.128.194:443
98.240.24.57:443
216.150.207.100:2222
71.74.12.34:443
71.197.126.250:443
98.121.187.78:443
47.196.192.184:443
74.222.204.82:995
74.68.144.202:443
67.165.206.193:993
71.182.142.63:443
109.12.111.14:443
68.129.194.130:443
31.57.48.136:443
94.53.92.42:443
65.27.228.247:443
71.14.110.199:443
84.247.55.190:8443
67.8.103.21:443
105.198.236.99:443
78.97.207.104:443
27.223.92.142:995
24.152.219.253:995
161.199.180.159:443
77.211.30.202:995
199.19.117.131:443
86.220.60.133:2222
96.37.113.36:993
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 616 regsvr32.exe 616 regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exepid process 4936 regsvr32.exe 4936 regsvr32.exe 4936 regsvr32.exe 4936 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4936 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 4768 wrote to memory of 4936 4768 regsvr32.exe regsvr32.exe PID 4768 wrote to memory of 4936 4768 regsvr32.exe regsvr32.exe PID 4768 wrote to memory of 4936 4768 regsvr32.exe regsvr32.exe PID 4936 wrote to memory of 3264 4936 regsvr32.exe explorer.exe PID 4936 wrote to memory of 3264 4936 regsvr32.exe explorer.exe PID 4936 wrote to memory of 3264 4936 regsvr32.exe explorer.exe PID 4936 wrote to memory of 3264 4936 regsvr32.exe explorer.exe PID 4936 wrote to memory of 3264 4936 regsvr32.exe explorer.exe PID 3264 wrote to memory of 4196 3264 explorer.exe schtasks.exe PID 3264 wrote to memory of 4196 3264 explorer.exe schtasks.exe PID 3264 wrote to memory of 4196 3264 explorer.exe schtasks.exe PID 684 wrote to memory of 616 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 616 684 regsvr32.exe regsvr32.exe PID 684 wrote to memory of 616 684 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iuhnoas /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll\"" /SC ONCE /Z /ST 22:53 /ET 23:054⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dllMD5
d48813a8c5758d4e5ed270919580ff2a
SHA1552a2c79f109cedc9d3963217e327a4ab3ac141a
SHA2567c9b82666e1db49005a121f6799be9cb072d5ebba2bfa44effd18e74815a50be
SHA5128501171a69166b1d8b490a4e02efc8696d9dc8543f1e538280689820a38a272aebd1b0f0260fc29adfec5682ddba60ba38287d302d902d8f11d82bebcd754d53
-
\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dllMD5
d48813a8c5758d4e5ed270919580ff2a
SHA1552a2c79f109cedc9d3963217e327a4ab3ac141a
SHA2567c9b82666e1db49005a121f6799be9cb072d5ebba2bfa44effd18e74815a50be
SHA5128501171a69166b1d8b490a4e02efc8696d9dc8543f1e538280689820a38a272aebd1b0f0260fc29adfec5682ddba60ba38287d302d902d8f11d82bebcd754d53
-
\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dllMD5
d48813a8c5758d4e5ed270919580ff2a
SHA1552a2c79f109cedc9d3963217e327a4ab3ac141a
SHA2567c9b82666e1db49005a121f6799be9cb072d5ebba2bfa44effd18e74815a50be
SHA5128501171a69166b1d8b490a4e02efc8696d9dc8543f1e538280689820a38a272aebd1b0f0260fc29adfec5682ddba60ba38287d302d902d8f11d82bebcd754d53
-
memory/616-12-0x0000000000000000-mapping.dmp
-
memory/3264-9-0x00000000003A0000-0x00000000003D5000-memory.dmpFilesize
212KB
-
memory/3264-7-0x0000000000000000-mapping.dmp
-
memory/3264-10-0x00000000003A0000-0x00000000003D5000-memory.dmpFilesize
212KB
-
memory/4196-8-0x0000000000000000-mapping.dmp
-
memory/4936-2-0x0000000000000000-mapping.dmp
-
memory/4936-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4936-5-0x0000000004E40000-0x0000000004E74000-memory.dmpFilesize
208KB
-
memory/4936-4-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4936-3-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB