Analysis
-
max time kernel
133s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-02-2021 20:15
Static task
static1
Behavioral task
behavioral1
Sample
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll
Resource
win7v20201028
General
-
Target
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll
-
Size
617KB
-
MD5
5e3749f332a005fadc0667375f8c6d19
-
SHA1
9271eb55dfe65239f20c6d6ac0f313a5f4fd54ff
-
SHA256
9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5
-
SHA512
ffcd6a8ce211ffa5175e066657490649d585ca8ec7b0606d92a34041740ef3d48b262cda9f960e41e4ccd3b32a48d3fbbdd519c68365c9b6fc5e778e8c1c04ef
Malware Config
Extracted
qakbot
tr
1612175155
89.3.198.238:443
172.78.30.215:443
85.52.72.32:2222
76.110.113.71:995
106.51.52.111:443
75.67.192.125:443
172.115.177.204:2222
197.45.110.165:995
82.76.47.211:443
45.77.115.208:443
45.32.211.207:443
144.202.38.185:443
207.246.116.237:995
149.28.101.90:995
149.28.101.90:8443
207.246.116.237:8443
144.202.38.185:2222
45.32.211.207:8443
149.28.101.90:443
149.28.101.90:2222
207.246.116.237:443
207.246.77.75:995
149.28.98.196:2222
149.28.99.97:443
149.28.99.97:995
149.28.99.97:2222
45.63.107.192:2222
45.63.107.192:443
144.202.38.185:995
45.32.211.207:2222
207.246.116.237:2222
207.246.77.75:2222
207.246.77.75:443
45.77.115.208:2222
207.246.77.75:8443
149.28.98.196:995
149.28.98.196:443
45.63.107.192:995
45.32.211.207:995
184.189.122.72:443
80.227.5.69:443
175.141.219.71:443
202.188.138.162:443
77.27.174.49:995
92.59.35.196:2222
81.97.154.100:443
45.77.115.208:995
45.77.115.208:8443
85.58.200.50:2222
86.97.8.63:443
50.240.77.238:22
203.198.96.37:443
24.50.118.93:443
190.85.91.154:443
176.181.247.197:443
41.205.16.1:443
78.63.226.32:443
184.179.14.130:22
193.248.221.184:2222
82.12.157.95:995
172.87.157.235:3389
51.9.198.164:2222
151.242.62.59:32103
70.126.76.75:443
160.3.187.114:443
69.58.147.82:2078
64.121.114.87:443
50.244.112.106:443
76.25.142.196:443
188.25.63.105:443
2.50.2.216:443
80.11.173.82:8443
83.110.103.152:443
140.82.49.12:443
84.72.35.226:443
71.88.193.17:443
74.77.162.33:443
68.186.192.69:443
46.153.119.255:995
213.60.147.140:443
216.201.162.158:443
81.88.254.62:443
196.151.252.84:443
105.186.102.16:443
71.187.170.235:443
68.225.60.77:995
95.77.223.148:443
105.198.236.101:443
81.214.126.173:2222
83.110.108.181:2222
202.184.20.119:443
83.110.12.140:2222
75.136.40.155:443
79.129.121.81:995
37.211.90.175:995
80.11.5.65:2222
85.132.36.111:2222
90.101.117.122:2222
105.96.8.96:443
86.236.77.68:2222
151.33.227.106:443
197.161.154.132:443
115.133.243.6:443
86.98.93.124:2078
156.223.24.221:443
50.29.166.232:995
2.232.253.79:995
2.7.69.217:2222
106.250.150.98:443
47.22.148.6:443
68.131.107.37:443
173.21.10.71:2222
31.5.21.66:995
78.182.229.147:443
69.123.179.70:443
75.118.1.141:443
144.139.47.206:443
45.46.53.140:2222
70.54.25.76:2222
75.136.26.147:443
144.139.166.18:443
67.6.12.4:443
76.111.128.194:443
98.240.24.57:443
216.150.207.100:2222
71.74.12.34:443
71.197.126.250:443
98.121.187.78:443
47.196.192.184:443
74.222.204.82:995
74.68.144.202:443
67.165.206.193:993
71.182.142.63:443
109.12.111.14:443
68.129.194.130:443
31.57.48.136:443
94.53.92.42:443
65.27.228.247:443
71.14.110.199:443
84.247.55.190:8443
67.8.103.21:443
105.198.236.99:443
78.97.207.104:443
27.223.92.142:995
24.152.219.253:995
161.199.180.159:443
77.211.30.202:995
199.19.117.131:443
86.220.60.133:2222
96.37.113.36:993
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2136 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4420 2136 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
regsvr32.exeWerFault.exepid process 4816 regsvr32.exe 4816 regsvr32.exe 4816 regsvr32.exe 4816 regsvr32.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe 4420 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4816 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4420 WerFault.exe Token: SeBackupPrivilege 4420 WerFault.exe Token: SeDebugPrivilege 4420 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 4688 wrote to memory of 4816 4688 regsvr32.exe regsvr32.exe PID 4688 wrote to memory of 4816 4688 regsvr32.exe regsvr32.exe PID 4688 wrote to memory of 4816 4688 regsvr32.exe regsvr32.exe PID 4816 wrote to memory of 1172 4816 regsvr32.exe explorer.exe PID 4816 wrote to memory of 1172 4816 regsvr32.exe explorer.exe PID 4816 wrote to memory of 1172 4816 regsvr32.exe explorer.exe PID 4816 wrote to memory of 1172 4816 regsvr32.exe explorer.exe PID 4816 wrote to memory of 1172 4816 regsvr32.exe explorer.exe PID 1172 wrote to memory of 3280 1172 explorer.exe schtasks.exe PID 1172 wrote to memory of 3280 1172 explorer.exe schtasks.exe PID 1172 wrote to memory of 3280 1172 explorer.exe schtasks.exe PID 4084 wrote to memory of 2136 4084 regsvr32.exe regsvr32.exe PID 4084 wrote to memory of 2136 4084 regsvr32.exe regsvr32.exe PID 4084 wrote to memory of 2136 4084 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn odplotff /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll\"" /SC ONCE /Z /ST 20:14 /ET 20:264⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dllMD5
d48813a8c5758d4e5ed270919580ff2a
SHA1552a2c79f109cedc9d3963217e327a4ab3ac141a
SHA2567c9b82666e1db49005a121f6799be9cb072d5ebba2bfa44effd18e74815a50be
SHA5128501171a69166b1d8b490a4e02efc8696d9dc8543f1e538280689820a38a272aebd1b0f0260fc29adfec5682ddba60ba38287d302d902d8f11d82bebcd754d53
-
\Users\Admin\AppData\Local\Temp\9c03fd876f1e5625e3dff0434d1185d624ab1203fa081c40ca2ebdb04aac27b5.dllMD5
d48813a8c5758d4e5ed270919580ff2a
SHA1552a2c79f109cedc9d3963217e327a4ab3ac141a
SHA2567c9b82666e1db49005a121f6799be9cb072d5ebba2bfa44effd18e74815a50be
SHA5128501171a69166b1d8b490a4e02efc8696d9dc8543f1e538280689820a38a272aebd1b0f0260fc29adfec5682ddba60ba38287d302d902d8f11d82bebcd754d53
-
memory/1172-9-0x0000000003240000-0x0000000003275000-memory.dmpFilesize
212KB
-
memory/1172-10-0x0000000003240000-0x0000000003275000-memory.dmpFilesize
212KB
-
memory/1172-7-0x0000000000000000-mapping.dmp
-
memory/2136-12-0x0000000000000000-mapping.dmp
-
memory/3280-8-0x0000000000000000-mapping.dmp
-
memory/4420-14-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/4816-2-0x0000000000000000-mapping.dmp
-
memory/4816-3-0x0000000002C50000-0x0000000002C51000-memory.dmpFilesize
4KB
-
memory/4816-6-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4816-5-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4816-4-0x0000000004760000-0x0000000004794000-memory.dmpFilesize
208KB