Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 11:32
Static task
static1
Behavioral task
behavioral1
Sample
test.test.dll
Resource
win7-en-20210920
General
-
Target
test.test.dll
-
Size
448KB
-
MD5
879628efe6fb566fc83cb019a4d90f5d
-
SHA1
b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
-
SHA256
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
-
SHA512
4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
Malware Config
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1100 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\80e7a5a8 = 89186d2ad4e72b7534c3597d039981493184b5cfc445f31445c085f9f347d6b11e7e375fd482a7ab3f5af6b0118c0259 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\45538d47 = 73e5003362edd4a88d5d5444b1f220ffcce0e13cf509216838df143e15ac2e50c0b788af0a6beba6f8e8a7678f66e327ddccc607cd175f19f56ef352d92450b6d835a93a996d63bb3143257349334931a89f84c539b3538f6c02367cee556c63a550 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\f8532ff = f4c55c6161d7ca200bd1249f64a8a10a328d423867e515dbab00ccab4f5135ed9d6dda206d2dc7c58a9e6b7d016b013ddc7ff92e1f13b4bfe2895cd288d14132931374da820c612948203682a6ff explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\f8532ff = f4c54b6161d7ff2d31b4d244bba2948911bc7abd67b4e55ce719087fae17977fc907bc9cfc4f045233da2e1ecf4c5185af5c43d09a04f91a95 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\3a1ae2b1 = edd30c108748106a1da4f9897e65739c5182e4921845b33f9c7a2b227e13167800fb0bb9f3922686010553f367e5e2d7bb6bdd12bbee04fe309345619b9f617d9a9682dae534559ae61540bf59711d5653a48fc651ff3c572e0f7228ef4ec1a248470c4bc3e11ae9b1bef1726b6ce6f1d9c63ac364f0eaf292beb2f86e69fc11dca8e9e5c112722ab4530e6e07016c98bff2c1d324ff48ffd24354545c7a2616a12093aad31468260ecf3d7f7a2053eb59f81c3774b8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\385bc2cd = b5125d23019854fc7de41e56640c9e73a4b3be7b686a4f8404e43c7ba67080877cbac089 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\70cc5d09 = 5456eda62c31974ce5318ef572b922c9394994876dbca8fa9ac29228cd2665b15dca96c096e8de90e4cb787ee0aede171a007d99306d9ec9903d0d54fe53f72be5474c2fadecb51bb34078dd395085b6790ad5369a21e1e3 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Alhlwgigbvlxnt explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\fdefea22 = 63982a3bd7d840d81a3595ac4bc530825b96d545868a0b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Alhlwgigbvlxnt\82a685d4 = 80d9ef9bdbb0e69c230562b2e74eab34a5f5a502a11a22f68af2bb53a64fac explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2036 rundll32.exe 1100 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2036 rundll32.exe 1100 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2036 1740 rundll32.exe rundll32.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 2036 wrote to memory of 1304 2036 rundll32.exe explorer.exe PID 1304 wrote to memory of 1468 1304 explorer.exe schtasks.exe PID 1304 wrote to memory of 1468 1304 explorer.exe schtasks.exe PID 1304 wrote to memory of 1468 1304 explorer.exe schtasks.exe PID 1304 wrote to memory of 1468 1304 explorer.exe schtasks.exe PID 1244 wrote to memory of 1976 1244 taskeng.exe regsvr32.exe PID 1244 wrote to memory of 1976 1244 taskeng.exe regsvr32.exe PID 1244 wrote to memory of 1976 1244 taskeng.exe regsvr32.exe PID 1244 wrote to memory of 1976 1244 taskeng.exe regsvr32.exe PID 1244 wrote to memory of 1976 1244 taskeng.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1976 wrote to memory of 1100 1976 regsvr32.exe regsvr32.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1100 wrote to memory of 1760 1100 regsvr32.exe explorer.exe PID 1760 wrote to memory of 1872 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1872 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1872 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1872 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1076 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1076 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1076 1760 explorer.exe reg.exe PID 1760 wrote to memory of 1076 1760 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vzalopx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 11:34 /ET 11:464⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {86691066-81B0-4250-8192-EFCF26DC2DCD} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kgaaen" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Royuewjisul" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
879628efe6fb566fc83cb019a4d90f5d
SHA1b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA5124c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
879628efe6fb566fc83cb019a4d90f5d
SHA1b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA5124c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
-
memory/1076-77-0x0000000000000000-mapping.dmp
-
memory/1100-75-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1100-70-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/1100-66-0x0000000000000000-mapping.dmp
-
memory/1304-57-0x0000000000000000-mapping.dmp
-
memory/1304-59-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB
-
memory/1304-62-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1468-60-0x0000000000000000-mapping.dmp
-
memory/1760-71-0x0000000000000000-mapping.dmp
-
memory/1760-76-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1872-74-0x0000000000000000-mapping.dmp
-
memory/1976-64-0x000007FEFC461000-0x000007FEFC463000-memory.dmpFilesize
8KB
-
memory/1976-63-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/2036-55-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/2036-53-0x0000000000000000-mapping.dmp
-
memory/2036-56-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/2036-54-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB