Analysis
-
max time kernel
135s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll
Resource
win7v20210408
General
-
Target
e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll
-
Size
294KB
-
MD5
759c097faed8a306ba9306c787565bc8
-
SHA1
bb5a578c31441f0588736151cba980c86787b98c
-
SHA256
e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852
-
SHA512
53d58b8e5ed2410a0c7a26dc8acf4ab9badb3fb6cf38b988766565eff8c819eeb8242f5d35d8285f63d7ba481d62dc1bd34094450eade5c4d480f41bea09a1f6
Malware Config
Extracted
qakbot
401.51
abc104
1606818862
79.119.124.237:443
87.218.53.206:2222
181.169.88.203:443
82.12.157.95:995
94.49.188.240:443
46.124.107.124:6881
86.122.248.164:2222
83.202.68.220:2222
79.129.216.215:2222
37.21.231.245:995
47.187.49.3:2222
2.90.33.130:443
149.28.98.196:995
149.28.99.97:443
45.63.107.192:995
149.28.98.196:2222
45.63.107.192:2222
74.73.27.35:443
149.28.98.196:443
144.202.38.185:2222
149.28.99.97:2222
45.77.193.83:443
144.202.38.185:995
24.95.61.62:443
95.77.223.148:443
71.187.170.235:443
39.36.30.92:995
188.26.243.119:443
78.187.125.116:2222
2.7.202.106:2222
178.80.62.24:443
91.104.44.226:995
81.214.126.173:2222
94.98.242.243:443
31.5.21.66:995
80.14.22.234:2222
98.121.187.78:443
47.44.217.98:443
82.10.43.130:2222
103.102.100.78:2222
45.118.65.34:443
176.45.233.94:995
81.247.148.252:995
211.24.72.253:443
189.231.3.63:443
41.227.76.249:443
156.222.155.185:995
75.136.40.155:443
92.154.83.96:2087
37.211.86.156:443
72.36.59.46:2222
219.76.148.249:443
2.50.56.81:443
47.21.192.182:2222
96.225.88.23:443
197.86.204.38:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
86.98.60.176:443
37.210.133.63:995
24.27.82.216:2222
82.127.125.209:20
79.115.171.106:2222
193.248.154.174:2222
172.78.30.215:443
79.166.96.86:2222
72.66.47.70:443
89.87.231.187:2222
72.29.181.78:2222
161.142.217.62:443
109.154.193.21:2222
86.245.87.251:2222
2.88.67.161:995
198.2.35.226:2222
83.110.206.115:995
2.89.183.206:443
151.16.241.219:443
110.142.205.182:443
85.98.177.32:443
78.181.19.134:443
102.185.242.27:443
90.101.117.122:2222
78.96.199.79:443
68.39.160.40:80
84.117.176.32:443
65.30.213.13:6882
42.201.228.106:995
80.195.103.146:2222
77.145.0.57:2222
94.59.236.155:995
1.43.86.247:2222
85.121.42.12:995
71.10.43.79:443
105.198.236.99:443
140.82.27.132:443
39.45.175.245:995
45.32.162.253:443
45.32.165.134:443
217.162.149.212:443
59.96.59.100:443
2.51.246.190:995
197.45.110.165:995
86.99.134.235:2222
24.179.13.119:443
176.181.247.197:443
68.131.19.52:443
86.98.34.84:995
184.21.136.237:995
65.131.47.74:995
185.105.131.233:443
81.133.234.36:2222
84.120.99.206:443
41.233.154.10:993
181.208.249.141:443
92.154.83.96:2222
92.154.83.96:1194
92.137.138.52:2222
175.140.23.200:443
46.177.174.186:443
203.106.195.67:443
172.87.157.235:443
121.58.199.24:443
151.60.163.18:443
73.51.245.231:995
37.210.131.246:443
151.27.89.199:443
41.237.210.179:995
94.69.112.148:2222
96.41.93.96:443
41.97.183.51:443
37.130.115.124:443
93.113.177.152:443
197.206.132.79:443
197.51.82.115:995
85.122.141.42:995
118.70.55.146:443
156.205.103.107:995
59.99.37.18:443
185.163.221.77:2222
39.32.55.12:995
62.38.114.12:2222
50.60.166.59:995
5.193.115.251:2222
58.152.9.133:443
196.151.252.84:443
120.151.95.167:443
178.222.114.132:995
97.119.234.37:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 748 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2024 rundll32.exe 2024 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 2024 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 1776 wrote to memory of 2024 1776 rundll32.exe rundll32.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 2024 wrote to memory of 1868 2024 rundll32.exe explorer.exe PID 1868 wrote to memory of 1308 1868 explorer.exe schtasks.exe PID 1868 wrote to memory of 1308 1868 explorer.exe schtasks.exe PID 1868 wrote to memory of 1308 1868 explorer.exe schtasks.exe PID 1868 wrote to memory of 1308 1868 explorer.exe schtasks.exe PID 744 wrote to memory of 640 744 taskeng.exe regsvr32.exe PID 744 wrote to memory of 640 744 taskeng.exe regsvr32.exe PID 744 wrote to memory of 640 744 taskeng.exe regsvr32.exe PID 744 wrote to memory of 640 744 taskeng.exe regsvr32.exe PID 744 wrote to memory of 640 744 taskeng.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe PID 640 wrote to memory of 748 640 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gyipivrxmo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll\"" /SC ONCE /Z /ST 16:10 /ET 16:224⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {A53EBE0C-2A8D-4F75-9053-752ECA673B98} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dllMD5
23231d543dfb5088054e58e18508ef94
SHA16d08bcb4a9fc1b7fa6c295407403060153e1f818
SHA2563a564348cdcb9985cde656f86f195b7181709d74341abb95358d6a05e0e749cb
SHA51290cff9b39aae76985521b64c0e99ec3ffa054ccc091440e8f06a11f2c6824169edad6f9982ad24f172af6f3013718cad8d1e59bf7252b2cfd310042ec2d7479b
-
\Users\Admin\AppData\Local\Temp\e9345360193f2145c60d4f90aee6ce0c895d1f6979e87a88cb1d45d9b00b9852.dllMD5
23231d543dfb5088054e58e18508ef94
SHA16d08bcb4a9fc1b7fa6c295407403060153e1f818
SHA2563a564348cdcb9985cde656f86f195b7181709d74341abb95358d6a05e0e749cb
SHA51290cff9b39aae76985521b64c0e99ec3ffa054ccc091440e8f06a11f2c6824169edad6f9982ad24f172af6f3013718cad8d1e59bf7252b2cfd310042ec2d7479b
-
memory/640-70-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmpFilesize
8KB
-
memory/640-69-0x0000000000000000-mapping.dmp
-
memory/748-72-0x0000000000000000-mapping.dmp
-
memory/1308-68-0x0000000000000000-mapping.dmp
-
memory/1868-67-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1868-66-0x0000000074511000-0x0000000074513000-memory.dmpFilesize
8KB
-
memory/1868-64-0x0000000000000000-mapping.dmp
-
memory/2024-60-0x0000000000000000-mapping.dmp
-
memory/2024-63-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2024-62-0x0000000000160000-0x00000000001AA000-memory.dmpFilesize
296KB
-
memory/2024-61-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB