Analysis
-
max time kernel
129s -
max time network
50s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 15:46
Static task
static1
Behavioral task
behavioral1
Sample
44467.7730002314.dat.dll
Resource
win7v20210408
General
-
Target
44467.7730002314.dat.dll
-
Size
750KB
-
MD5
e2ea31f06e36a66fe29fdad302410e36
-
SHA1
6e7b7faee6212f233373c559f0e8900f80b7098a
-
SHA256
05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
-
SHA512
87b3af9ce4f72e6c7d2920654f6dde2ed274674bf6b3e3092ab987aceb29c2d47b9ee512a4c044e64a37ba703eff775c575d5cfddb64986eafd2572cab442f87
Malware Config
Extracted
qakbot
402.363
obama105
1632821932
120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1060 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1988 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1988 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1988 1980 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1988 wrote to memory of 1828 1988 rundll32.exe explorer.exe PID 1828 wrote to memory of 1836 1828 explorer.exe schtasks.exe PID 1828 wrote to memory of 1836 1828 explorer.exe schtasks.exe PID 1828 wrote to memory of 1836 1828 explorer.exe schtasks.exe PID 1828 wrote to memory of 1836 1828 explorer.exe schtasks.exe PID 568 wrote to memory of 1460 568 taskeng.exe regsvr32.exe PID 568 wrote to memory of 1460 568 taskeng.exe regsvr32.exe PID 568 wrote to memory of 1460 568 taskeng.exe regsvr32.exe PID 568 wrote to memory of 1460 568 taskeng.exe regsvr32.exe PID 568 wrote to memory of 1460 568 taskeng.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe PID 1460 wrote to memory of 1060 1460 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kfkwenotap /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dll\"" /SC ONCE /Z /ST 17:50 /ET 18:024⤵
- Creates scheduled task(s)
PID:1836
-
C:\Windows\system32\taskeng.exetaskeng.exe {95A61843-B289-470C-BF03-06E868486472} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dll"3⤵
- Loads dropped DLL
PID:1060
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dllMD5
e2ea31f06e36a66fe29fdad302410e36
SHA16e7b7faee6212f233373c559f0e8900f80b7098a
SHA25605bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
SHA51287b3af9ce4f72e6c7d2920654f6dde2ed274674bf6b3e3092ab987aceb29c2d47b9ee512a4c044e64a37ba703eff775c575d5cfddb64986eafd2572cab442f87
-
\Users\Admin\AppData\Local\Temp\44467.7730002314.dat.dllMD5
e2ea31f06e36a66fe29fdad302410e36
SHA16e7b7faee6212f233373c559f0e8900f80b7098a
SHA25605bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
SHA51287b3af9ce4f72e6c7d2920654f6dde2ed274674bf6b3e3092ab987aceb29c2d47b9ee512a4c044e64a37ba703eff775c575d5cfddb64986eafd2572cab442f87
-
memory/1060-73-0x0000000000000000-mapping.dmp
-
memory/1460-70-0x0000000000000000-mapping.dmp
-
memory/1460-71-0x000007FEFC051000-0x000007FEFC053000-memory.dmpFilesize
8KB
-
memory/1828-67-0x0000000074CC1000-0x0000000074CC3000-memory.dmpFilesize
8KB
-
memory/1828-69-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1828-65-0x0000000000000000-mapping.dmp
-
memory/1836-68-0x0000000000000000-mapping.dmp
-
memory/1988-60-0x0000000000000000-mapping.dmp
-
memory/1988-64-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1988-63-0x0000000074EA0000-0x0000000074F72000-memory.dmpFilesize
840KB
-
memory/1988-62-0x0000000074EA0000-0x0000000074EC1000-memory.dmpFilesize
132KB
-
memory/1988-61-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB