Analysis
-
max time kernel
127s -
max time network
118s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 19:20
Static task
static1
Behavioral task
behavioral1
Sample
Qakbot_2.red.dll
Resource
win7v20210408
General
-
Target
Qakbot_2.red.dll
-
Size
378KB
-
MD5
7df93445d7752cd944b727d3824ebb55
-
SHA1
119352f971e74f397d5f78301b144c22be8f944f
-
SHA256
31a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898
-
SHA512
daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8
Malware Config
Extracted
qakbot
402.343
obama104
1632729661
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3148 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\2ad627b1 = b4ccbb660f8b428978098b86b199b1733caf4e8eca982cde8724e3005f9821e69c0bd72a0423c16f5a796e1abca5c9c5929f1597ca8c30bc854ff887d55c1b595ed65da35ae201adc3a763c1537351ca8aa751a1ea4f91b0fa8b7680f8315eb99628 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\926a40d4 = 727e9a71540258a37327dacc85e9c82af651a3014250924f022d138e8bcefbe1f34f5c698d2710b21d1cef4905c2e2729a058a3d7d7c316009023f6ca25fbc1ec8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\57de683b = 1bb1b7ff966c81a989f735ab6130513a2a5785be1e0d0ca358d77ccc3d6c027837d5eb222cdbb5b300db08417c64e65debc3b5c49882b103d83c9064c5c903177f0dbd5b2ced057d9e2193d64a4d10c4eebe8438cf895570cc explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\902b60a8 = fcb046cd600a7f9cc01ce785a51457cd1d88352cd8d81cfcd004950e115d186e5273cdd3bd9c1606e18f2372db7cfbfb9cf72c42e7d7b43f9fba0a0a2cf9ba0e8be122b87ab2c0fc0faf3e0f7463f19852663cab8e explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\1d08d783 = 33dda052e227c4007895be45f2a4dc80a3e4d03c7a7634b6de3279b69f4d119d02ce62b23c42b56c721f556fde291c7f12e43447aefffa2cda7a4f2eb81e3a24429ead69d5d22613a52366da230ff412f233c4a889f15cfa9e8e6d4283 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\289707cd = dfe12c2ca0cf4c8c7efba894b39dac7b412009c87532d9e7dec169f8c2572ac2cb2af4acd7f1777cb7c964779f7e83feda9441c7b562e29102dc3b39a735456a4135f458bc12274749ed6d4a174cc695ff295fc3085f8f80d276b2f28bb5fb55d610fde01b486096bedff3414a710964d502 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\ef620f5e = 349aaaaf3b5c42e87ae6acfaf11f8c1539e037c0a4b58d7c0aeae83a0b1a90472b4c6773f4958efe9bc1e71a64e5cba8401b79c41715f915984a3b892854701931b4e6153a93 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\6241b875 = abe686d1993e6fdaaa9fb47526c522c5a64416072ec9e5c4c7749776892891534cf78e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Xfaiqku\1d08d783 = 33ddb752e227f1b0cefb612b7008eba1820295d72d2342fc76eb7fbb59c12c5cf0bfb00e9a70eeee5581576941b41d0b1f600c9c8c769c84da081d3807fc0535630d828b3c97e32a597ec8d1fdd66dc84c0a6a6ec049a9e4e2f37565c1046bd27fb1b2101ae5ff8973c689c5510a92545d24 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3596 rundll32.exe 3596 rundll32.exe 3148 regsvr32.exe 3148 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3596 rundll32.exe 3148 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3512 wrote to memory of 3596 3512 rundll32.exe rundll32.exe PID 3512 wrote to memory of 3596 3512 rundll32.exe rundll32.exe PID 3512 wrote to memory of 3596 3512 rundll32.exe rundll32.exe PID 3596 wrote to memory of 4132 3596 rundll32.exe explorer.exe PID 3596 wrote to memory of 4132 3596 rundll32.exe explorer.exe PID 3596 wrote to memory of 4132 3596 rundll32.exe explorer.exe PID 3596 wrote to memory of 4132 3596 rundll32.exe explorer.exe PID 3596 wrote to memory of 4132 3596 rundll32.exe explorer.exe PID 4132 wrote to memory of 2640 4132 explorer.exe schtasks.exe PID 4132 wrote to memory of 2640 4132 explorer.exe schtasks.exe PID 4132 wrote to memory of 2640 4132 explorer.exe schtasks.exe PID 3120 wrote to memory of 3148 3120 regsvr32.exe regsvr32.exe PID 3120 wrote to memory of 3148 3120 regsvr32.exe regsvr32.exe PID 3120 wrote to memory of 3148 3120 regsvr32.exe regsvr32.exe PID 3148 wrote to memory of 4392 3148 regsvr32.exe explorer.exe PID 3148 wrote to memory of 4392 3148 regsvr32.exe explorer.exe PID 3148 wrote to memory of 4392 3148 regsvr32.exe explorer.exe PID 3148 wrote to memory of 4392 3148 regsvr32.exe explorer.exe PID 3148 wrote to memory of 4392 3148 regsvr32.exe explorer.exe PID 4392 wrote to memory of 3992 4392 explorer.exe reg.exe PID 4392 wrote to memory of 3992 4392 explorer.exe reg.exe PID 4392 wrote to memory of 3128 4392 explorer.exe reg.exe PID 4392 wrote to memory of 3128 4392 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ymfubtobp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll\"" /SC ONCE /Z /ST 19:22 /ET 19:344⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mkkjlmiqx" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Mateoodamiz" /d "0"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dllMD5
7df93445d7752cd944b727d3824ebb55
SHA1119352f971e74f397d5f78301b144c22be8f944f
SHA25631a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898
SHA512daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8
-
\Users\Admin\AppData\Local\Temp\Qakbot_2.red.dllMD5
7df93445d7752cd944b727d3824ebb55
SHA1119352f971e74f397d5f78301b144c22be8f944f
SHA25631a90ad6dbe61a0a90ee10802efa1a6ea8cc5edbeb3b74e79f7d07293cd56898
SHA512daab59fbf601e2ca1bc75259adb0ea39cc32cc767479e09f33c0f37a1d46d6cc4049f5f2a13af0fe8eeb28c429fa4bffde215b6a07dbcec2d216593084353da8
-
memory/2640-119-0x0000000000000000-mapping.dmp
-
memory/3128-129-0x0000000000000000-mapping.dmp
-
memory/3148-126-0x0000000003CF0000-0x0000000003D32000-memory.dmpFilesize
264KB
-
memory/3148-124-0x0000000000000000-mapping.dmp
-
memory/3596-117-0x0000000010000000-0x0000000010062000-memory.dmpFilesize
392KB
-
memory/3596-115-0x0000000000000000-mapping.dmp
-
memory/3596-116-0x0000000004590000-0x00000000045B3000-memory.dmpFilesize
140KB
-
memory/3992-128-0x0000000000000000-mapping.dmp
-
memory/4132-122-0x0000000003200000-0x0000000003221000-memory.dmpFilesize
132KB
-
memory/4132-118-0x0000000000000000-mapping.dmp
-
memory/4392-127-0x0000000000000000-mapping.dmp
-
memory/4392-132-0x0000000000460000-0x0000000000481000-memory.dmpFilesize
132KB