Analysis
-
max time kernel
138s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
07-05-2021 10:08
Static task
static1
Behavioral task
behavioral1
Sample
cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll
Resource
win7v20210408
General
-
Target
cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll
-
Size
909KB
-
MD5
ee0a11ed10588b6c7c35b6a36f0998da
-
SHA1
21e0eb33704b6dcf2e1899d90d6600a5db60e864
-
SHA256
cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80
-
SHA512
e5319309a939ab8be761b94247e8f196a315f0e8bf66d1e31a94bde2f853dbc5143a2a2906ba0c0f2ef6f652e761de8befb78f545e6ea59aae9222e87fb4ec20
Malware Config
Extracted
qakbot
401.138
domain02
1613028094
32.210.98.6:443
70.49.88.199:2222
151.205.102.42:443
178.152.79.153:995
216.195.46.163:2222
72.252.201.69:443
90.65.236.181:2222
98.173.34.212:995
97.69.160.4:2222
69.245.102.225:443
144.139.166.18:443
73.25.124.140:2222
189.223.205.126:443
157.131.108.180:443
71.197.126.250:443
73.228.197.5:443
151.213.189.62:443
24.229.150.54:995
84.72.35.226:443
199.19.117.131:443
189.146.183.105:443
195.12.154.8:443
172.87.157.235:3389
81.88.254.62:443
71.199.192.62:443
109.12.111.14:443
76.177.232.22:443
209.210.187.52:443
81.97.154.100:443
67.8.103.21:443
24.50.118.93:443
149.28.99.97:443
149.28.99.97:2222
149.28.99.97:995
45.63.107.192:2222
45.63.107.192:443
45.63.107.192:995
149.28.98.196:2222
149.28.98.196:995
149.28.98.196:443
144.202.38.185:2222
144.202.38.185:995
144.202.38.185:443
45.32.211.207:443
45.32.211.207:995
45.32.211.207:8443
45.32.211.207:2222
149.28.101.90:443
149.28.101.90:995
149.28.101.90:2222
149.28.101.90:8443
45.77.115.208:443
45.77.115.208:995
45.77.115.208:2222
45.77.115.208:8443
207.246.77.75:443
207.246.77.75:995
207.246.77.75:2222
207.246.77.75:8443
207.246.116.237:443
207.246.116.237:8443
207.246.116.237:995
207.246.116.237:2222
86.220.60.133:2222
24.55.112.61:443
71.163.223.159:443
186.28.51.27:443
189.149.77.114:443
98.252.118.134:443
82.12.157.95:995
108.46.145.30:443
197.161.154.132:443
122.148.156.131:995
96.61.23.88:995
71.117.132.169:443
108.160.123.244:443
76.30.63.164:443
176.181.247.197:443
89.137.211.239:995
80.11.173.82:8443
73.153.211.227:443
81.150.181.168:2222
47.187.115.228:443
50.244.112.106:443
140.82.49.12:443
201.143.235.13:443
68.50.197.143:443
201.170.135.141:995
82.76.47.211:443
173.184.119.153:995
67.165.206.193:993
46.153.118.161:995
77.211.30.202:995
47.147.6.66:443
209.210.187.52:995
78.63.226.32:443
41.58.111.164:3389
73.4.146.225:443
90.101.117.122:2222
189.210.115.207:443
190.85.91.154:443
24.139.72.117:443
68.186.192.69:443
151.60.178.141:443
71.88.193.17:443
96.57.188.174:2222
75.118.1.141:443
70.168.130.172:995
86.160.137.132:443
86.236.77.68:2222
68.225.60.77:995
81.214.126.173:2222
94.53.92.42:443
160.3.187.114:443
38.92.225.121:443
47.217.24.69:443
201.114.220.210:443
78.22.58.205:3389
71.187.170.235:443
188.24.130.121:443
75.136.26.147:443
216.201.162.158:443
74.68.144.202:443
77.27.204.204:995
172.78.30.215:443
23.235.26.247:443
75.67.192.125:443
96.21.251.127:2222
196.151.252.84:443
24.95.61.62:443
179.113.183.60:995
189.223.234.23:995
47.187.74.181:443
125.239.152.76:995
74.222.204.82:995
76.25.142.196:443
75.136.40.155:443
69.123.179.70:443
189.211.177.183:995
47.22.148.6:443
24.30.62.205:443
98.192.185.86:443
213.60.147.140:443
106.51.85.162:443
98.240.24.57:443
208.126.142.17:443
95.77.223.148:443
45.46.53.140:2222
50.25.89.74:443
105.198.236.99:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 564 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1488 rundll32.exe 1488 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1488 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1608 wrote to memory of 1488 1608 rundll32.exe rundll32.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1488 wrote to memory of 1380 1488 rundll32.exe explorer.exe PID 1380 wrote to memory of 1232 1380 explorer.exe schtasks.exe PID 1380 wrote to memory of 1232 1380 explorer.exe schtasks.exe PID 1380 wrote to memory of 1232 1380 explorer.exe schtasks.exe PID 1380 wrote to memory of 1232 1380 explorer.exe schtasks.exe PID 1820 wrote to memory of 744 1820 taskeng.exe regsvr32.exe PID 1820 wrote to memory of 744 1820 taskeng.exe regsvr32.exe PID 1820 wrote to memory of 744 1820 taskeng.exe regsvr32.exe PID 1820 wrote to memory of 744 1820 taskeng.exe regsvr32.exe PID 1820 wrote to memory of 744 1820 taskeng.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe PID 744 wrote to memory of 564 744 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn awnfnyto /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll\"" /SC ONCE /Z /ST 12:07 /ET 12:194⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {8FFB2E35-2088-4DF1-A7F3-B569A48DF045} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dllMD5
621d952bf7bcadc949871ac623e2b881
SHA140dc7ebd3956590b59df0c8e2ed37960cb96b11c
SHA256793d15bca780af4ddbdaabc95a3b5cc1db4560858eb892ac8bb9126e86fb6c1c
SHA512bc81289d0fd93b3657940d3f80309db0898919e2781ea9d8845e4e256aa0299d6e6d7161328ab4f4fddca22bd42887431eff9e2448d6fb843618ad7256fe367d
-
\Users\Admin\AppData\Local\Temp\cf6fea34af1f1e02cfc44a685bc90c9c8c04e18a722ccf61ec73d952df774f80.dllMD5
621d952bf7bcadc949871ac623e2b881
SHA140dc7ebd3956590b59df0c8e2ed37960cb96b11c
SHA256793d15bca780af4ddbdaabc95a3b5cc1db4560858eb892ac8bb9126e86fb6c1c
SHA512bc81289d0fd93b3657940d3f80309db0898919e2781ea9d8845e4e256aa0299d6e6d7161328ab4f4fddca22bd42887431eff9e2448d6fb843618ad7256fe367d
-
memory/564-74-0x0000000000000000-mapping.dmp
-
memory/744-72-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/744-71-0x0000000000000000-mapping.dmp
-
memory/1232-70-0x0000000000000000-mapping.dmp
-
memory/1380-66-0x0000000000000000-mapping.dmp
-
memory/1380-68-0x0000000074131000-0x0000000074133000-memory.dmpFilesize
8KB
-
memory/1380-69-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/1488-60-0x0000000000000000-mapping.dmp
-
memory/1488-65-0x0000000000310000-0x0000000000345000-memory.dmpFilesize
212KB
-
memory/1488-64-0x0000000000230000-0x0000000000264000-memory.dmpFilesize
208KB
-
memory/1488-63-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1488-62-0x0000000000830000-0x0000000000917000-memory.dmpFilesize
924KB
-
memory/1488-61-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB