Analysis
-
max time kernel
147s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-09-2021 11:32
Static task
static1
Behavioral task
behavioral1
Sample
test.test.dll
Resource
win7-en-20210920
General
-
Target
test.test.dll
-
Size
448KB
-
MD5
879628efe6fb566fc83cb019a4d90f5d
-
SHA1
b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
-
SHA256
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
-
SHA512
4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
Malware Config
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1924 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\550c72b9 = 6a524c0c9f8ae4ec322f68d5080068ff1a7b56b4d8b99773bf2f567ba271667ee70646c1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\edb015dc = 1a634982b53de5adca6fb20ded98a17ced507c0973c361b053bfb4fa68a0f5e9f0cba6de461ff27d37527c47a909c1231ac49d6377a98a4e33c214d3e45c52bbeefede1dd730f9a502ee explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\a766aa64 = fb9864db2436e53688d6ed6234abca81e9956e2b251a23835a60a1f4b7e2e6097238943946a947f95b77ee96fd9c315d1e68c0d7f3a3d4fa6174fd6eef4a7072c55d3dc076eeb4b8a508a41064c9d3763568fcfd3659e7b4235413b84b1a10f3ea067d722239460cf25b0a26df8820d8f348 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\a766aa64 = fb9873db2436d0478f09f802de0193d191b317bacd6f64064a4e2b71389581e7350a2dbca8edb5a822519b1084be0a3bb275ae9545fbdc64754115ec55fa479eb0493a1b2ede5e0cfdeff1ccef7aaa6cda9d70e524c36f695023e125d4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\92f97a2a = 3cdc49e1144eaeb99b3cdddb0d93012d26436eec0f55f29bd3efb3ed5cce0e814586b5ddd4a787c4e1deee43a7c8ffa8c0651f928855fac0af7354ea8f15c6101daf4e715e3cf322921cb530d758fa52ec5a981ebac66b22539d76fdd8ac62159ccdf98ffe95dc1fc0cc1e5f59a629d0e345a4b438ed8e86c27b85a4e0d01b320858fe50f96af4a2df745941fb48728b23db8c220ad370b347d7025712156b5b14ad54a9add5c5e6c43b31753e2d1e8169ab explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\28043d33 = 5939b4ea4e08153775e3add7f951cf7be96822c824e16e3fb19acaad6692071ce360358a0be45ca340413d08c32c764e389a875eedbff26e21ac2b167773bb87b779c4e88b268b283bec7fbfd2c44e02eef16a737a19c9a318fc0a954d3e13000d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\2a451d4f = 861e5898839edb03bbc7b54518d965bb85c13edf6909856b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\d82fc592 = e24bcad79d9fff19532ea6288b356b6078ef67ed33b3b3073093e56b11fe524dd4bcdb91966cfc2f9d666c212184264ac16c56c2c130bc9da660cf88157483929f6763dc26147d48a443ef01e561dfcfb094128419ef930ca8c0713f540dbcdfa4c39ef1c1a4 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Knyruvin\90b85a56 = e6e3634d7c24729ffefaa1e2a3120ea0 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3624 rundll32.exe 3624 rundll32.exe 1924 regsvr32.exe 1924 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 3624 rundll32.exe 1924 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3464 wrote to memory of 3624 3464 rundll32.exe rundll32.exe PID 3464 wrote to memory of 3624 3464 rundll32.exe rundll32.exe PID 3464 wrote to memory of 3624 3464 rundll32.exe rundll32.exe PID 3624 wrote to memory of 3748 3624 rundll32.exe explorer.exe PID 3624 wrote to memory of 3748 3624 rundll32.exe explorer.exe PID 3624 wrote to memory of 3748 3624 rundll32.exe explorer.exe PID 3624 wrote to memory of 3748 3624 rundll32.exe explorer.exe PID 3624 wrote to memory of 3748 3624 rundll32.exe explorer.exe PID 3748 wrote to memory of 3864 3748 explorer.exe schtasks.exe PID 3748 wrote to memory of 3864 3748 explorer.exe schtasks.exe PID 3748 wrote to memory of 3864 3748 explorer.exe schtasks.exe PID 4052 wrote to memory of 1924 4052 regsvr32.exe regsvr32.exe PID 4052 wrote to memory of 1924 4052 regsvr32.exe regsvr32.exe PID 4052 wrote to memory of 1924 4052 regsvr32.exe regsvr32.exe PID 1924 wrote to memory of 4272 1924 regsvr32.exe explorer.exe PID 1924 wrote to memory of 4272 1924 regsvr32.exe explorer.exe PID 1924 wrote to memory of 4272 1924 regsvr32.exe explorer.exe PID 1924 wrote to memory of 4272 1924 regsvr32.exe explorer.exe PID 1924 wrote to memory of 4272 1924 regsvr32.exe explorer.exe PID 4272 wrote to memory of 4264 4272 explorer.exe reg.exe PID 4272 wrote to memory of 4264 4272 explorer.exe reg.exe PID 4272 wrote to memory of 4468 4272 explorer.exe reg.exe PID 4272 wrote to memory of 4468 4272 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dhsdmtkgc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 11:34 /ET 11:464⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Idfooobflb" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iukdvyxbee" /d "0"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
879628efe6fb566fc83cb019a4d90f5d
SHA1b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA5124c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
879628efe6fb566fc83cb019a4d90f5d
SHA1b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
SHA256b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
SHA5124c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
-
memory/1924-129-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/1924-128-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/1924-125-0x0000000000000000-mapping.dmp
-
memory/3624-116-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/3624-117-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/3624-118-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3624-115-0x0000000000000000-mapping.dmp
-
memory/3748-119-0x0000000000000000-mapping.dmp
-
memory/3748-123-0x00000000032B0000-0x00000000032D1000-memory.dmpFilesize
132KB
-
memory/3864-120-0x0000000000000000-mapping.dmp
-
memory/4264-131-0x0000000000000000-mapping.dmp
-
memory/4272-130-0x0000000000000000-mapping.dmp
-
memory/4272-135-0x00000000032B0000-0x00000000032D1000-memory.dmpFilesize
132KB
-
memory/4468-132-0x0000000000000000-mapping.dmp