Analysis
-
max time kernel
108s -
max time network
100s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-09-2021 12:37
Static task
static1
Behavioral task
behavioral1
Sample
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
Resource
win7v20210408
General
-
Target
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
-
Size
448KB
-
MD5
879628efe6fb566fc83cb019a4d90f5d
-
SHA1
b4eb4da4ed99f50c0e02b12c23b2ea65dceed706
-
SHA256
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
-
SHA512
4c5ec0815de1112bc633afb96f50f03bc9506246ce1e4bc6aa8c5b6690941339b16a26f33f7999ba02dc5c460f846da51b4ed2a8f041a68c4bc8991fe2cd8a1c
Malware Config
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1704 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1704 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exedescription pid process target process PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 760 wrote to memory of 1704 760 rundll32.exe rundll32.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1704 wrote to memory of 1716 1704 rundll32.exe explorer.exe PID 1716 wrote to memory of 1060 1716 explorer.exe schtasks.exe PID 1716 wrote to memory of 1060 1716 explorer.exe schtasks.exe PID 1716 wrote to memory of 1060 1716 explorer.exe schtasks.exe PID 1716 wrote to memory of 1060 1716 explorer.exe schtasks.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qhzetwvwgp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll\"" /SC ONCE /Z /ST 14:41 /ET 14:534⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-67-0x0000000000000000-mapping.dmp
-
memory/1704-60-0x0000000000000000-mapping.dmp
-
memory/1704-61-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/1704-63-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/1704-62-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/1704-68-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1716-64-0x0000000000000000-mapping.dmp
-
memory/1716-66-0x0000000074BF1000-0x0000000074BF3000-memory.dmpFilesize
8KB
-
memory/1716-69-0x00000000000E0000-0x0000000000101000-memory.dmpFilesize
132KB