Analysis
-
max time kernel
116s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-03-2021 14:39
Static task
static1
Behavioral task
behavioral1
Sample
e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll
Resource
win7v20201028
General
-
Target
e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll
-
Size
349KB
-
MD5
cd6461213b090d7c4eed79431d4a684f
-
SHA1
bda16ee8758cea58d83cf2b34efaf0fab6fc42a3
-
SHA256
e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f
-
SHA512
81c8ee342401ea4b1eaa945f8557ecb95f81f91220dd8f110b510db2da7632aa3636a2fd72d3d1a70f213277070627ab8b0e624796b8ec0cc7aa2949fd31b7db
Malware Config
Extracted
qakbot
tr
1614598087
24.95.61.62:443
89.3.198.238:443
196.151.252.84:443
90.65.236.181:2222
2.232.253.79:995
217.133.54.140:32100
195.43.173.70:443
84.247.55.190:8443
136.232.34.70:443
45.63.107.192:443
45.77.115.208:443
149.28.98.196:995
45.32.211.207:8443
149.28.98.196:443
149.28.99.97:443
45.63.107.192:2222
207.246.77.75:443
207.246.77.75:8443
45.77.117.108:443
45.32.211.207:995
144.202.38.185:2222
144.202.38.185:995
149.28.101.90:443
207.246.77.75:2222
207.246.77.75:995
45.77.115.208:2222
45.77.115.208:8443
207.246.116.237:443
207.246.116.237:2222
45.77.117.108:8443
149.28.98.196:2222
144.202.38.185:443
149.28.101.90:8443
149.28.101.90:2222
45.77.115.208:995
207.246.116.237:8443
207.246.116.237:995
45.77.117.108:995
45.77.117.108:2222
122.148.156.131:995
149.28.101.90:995
45.32.211.207:443
45.32.211.207:2222
149.28.99.97:2222
149.28.99.97:995
209.210.187.52:995
85.52.72.32:2222
86.236.77.68:2222
71.199.192.62:443
71.117.132.169:443
75.67.192.125:443
172.87.157.235:3389
79.115.174.55:443
95.77.223.148:443
83.110.9.71:2222
84.72.35.226:443
193.248.221.184:2222
68.186.192.69:443
75.136.40.155:443
2.7.116.188:2222
140.82.49.12:443
202.184.20.119:443
182.48.193.200:443
81.97.154.100:443
47.22.148.6:443
80.11.173.82:8443
213.60.147.140:443
197.161.154.132:443
89.137.211.239:995
78.180.179.136:443
83.196.56.65:2222
115.133.243.6:443
59.90.246.200:443
113.22.175.141:443
105.198.236.101:443
80.227.5.69:443
83.110.103.152:443
216.201.162.158:443
97.69.160.4:2222
65.27.228.247:443
75.118.1.141:443
81.214.126.173:2222
71.74.12.34:443
189.222.217.105:443
75.136.26.147:443
173.21.10.71:2222
203.198.96.249:443
73.153.211.227:443
197.45.110.165:995
144.139.166.18:443
76.25.142.196:443
96.37.113.36:993
71.197.126.250:443
24.43.22.218:993
74.222.204.82:995
67.6.12.4:443
108.29.32.251:443
142.117.191.18:2222
50.29.166.232:995
32.210.98.6:443
98.240.24.57:443
45.46.53.140:2222
172.78.30.215:443
47.196.192.184:443
186.31.77.42:443
83.110.108.38:2222
78.97.207.104:443
78.63.226.32:443
109.12.111.14:443
71.14.110.199:443
80.7.129.64:995
87.202.87.210:2222
74.68.144.202:443
196.221.207.137:995
197.51.82.72:443
202.188.138.162:443
176.181.247.197:443
189.222.199.37:995
188.26.91.212:443
41.39.134.183:443
98.192.185.86:443
105.96.8.96:443
47.187.108.172:443
105.198.236.99:443
94.53.92.42:443
174.104.22.30:443
189.222.59.177:443
181.48.190.78:443
119.157.106.105:3389
189.146.183.105:443
45.118.216.157:443
125.209.114.182:995
173.25.45.66:443
199.19.117.131:443
98.252.118.134:443
67.8.103.21:443
125.239.152.76:995
187.250.177.33:995
189.210.115.207:443
151.205.102.42:443
106.51.85.162:443
72.240.200.181:2222
72.252.201.69:443
209.210.187.52:443
108.46.145.30:443
24.139.72.117:443
71.163.223.159:443
24.229.150.54:995
45.63.107.192:995
82.12.157.95:995
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1564 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3028 1564 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
rundll32.exeWerFault.exepid process 652 rundll32.exe 652 rundll32.exe 652 rundll32.exe 652 rundll32.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 652 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3028 WerFault.exe Token: SeBackupPrivilege 3028 WerFault.exe Token: SeDebugPrivilege 3028 WerFault.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exedescription pid process target process PID 1400 wrote to memory of 652 1400 rundll32.exe rundll32.exe PID 1400 wrote to memory of 652 1400 rundll32.exe rundll32.exe PID 1400 wrote to memory of 652 1400 rundll32.exe rundll32.exe PID 652 wrote to memory of 692 652 rundll32.exe explorer.exe PID 652 wrote to memory of 692 652 rundll32.exe explorer.exe PID 652 wrote to memory of 692 652 rundll32.exe explorer.exe PID 652 wrote to memory of 692 652 rundll32.exe explorer.exe PID 652 wrote to memory of 692 652 rundll32.exe explorer.exe PID 692 wrote to memory of 4092 692 explorer.exe schtasks.exe PID 692 wrote to memory of 4092 692 explorer.exe schtasks.exe PID 692 wrote to memory of 4092 692 explorer.exe schtasks.exe PID 936 wrote to memory of 1564 936 regsvr32.exe regsvr32.exe PID 936 wrote to memory of 1564 936 regsvr32.exe regsvr32.exe PID 936 wrote to memory of 1564 936 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sabmixvxti /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll\"" /SC ONCE /Z /ST 15:45 /ET 15:574⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dllMD5
a48a5b29ae8c4960912f2d0d8649e816
SHA12f0435e2b647a85b5287f25f2e44e343b63c25df
SHA25645d55a4d11c654c7dacad8445b0ad2be33de165a68e9ecaffdec020a5615875c
SHA5128ab6791d96683b323f8f1df5f3b64f838af1a546e6963288aa0eb9f05c1c30ef2364765cbf210550a1d2eb25158f2c874a23c9bbf232a90375cfd5d24ab4c8fe
-
\Users\Admin\AppData\Local\Temp\e89ce5206b133790f9313989ebfbbd2eee1e4d9cee7c1dcfc1d0f895cda8662f.dllMD5
a48a5b29ae8c4960912f2d0d8649e816
SHA12f0435e2b647a85b5287f25f2e44e343b63c25df
SHA25645d55a4d11c654c7dacad8445b0ad2be33de165a68e9ecaffdec020a5615875c
SHA5128ab6791d96683b323f8f1df5f3b64f838af1a546e6963288aa0eb9f05c1c30ef2364765cbf210550a1d2eb25158f2c874a23c9bbf232a90375cfd5d24ab4c8fe
-
memory/652-2-0x0000000000000000-mapping.dmp
-
memory/652-3-0x0000000004DB0000-0x000000000D005000-memory.dmpFilesize
130.3MB
-
memory/652-4-0x0000000010000000-0x0000000018255000-memory.dmpFilesize
130.3MB
-
memory/692-5-0x0000000000000000-mapping.dmp
-
memory/692-7-0x00000000028C0000-0x00000000028F5000-memory.dmpFilesize
212KB
-
memory/692-8-0x00000000028C0000-0x00000000028F5000-memory.dmpFilesize
212KB
-
memory/1564-10-0x0000000000000000-mapping.dmp
-
memory/3028-12-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/4092-6-0x0000000000000000-mapping.dmp