Analysis
-
max time kernel
139s -
max time network
23s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-10-2021 13:18
Static task
static1
Behavioral task
behavioral1
Sample
test.test.dll
Resource
win7-en-20210920
General
-
Target
test.test.dll
-
Size
573KB
-
MD5
fa3ad164c7198e0bf3747ffa1f84d074
-
SHA1
ebdd0932906db624c500d27184fa46814354756c
-
SHA256
0c6a5acc3823fdd07d2096562030a3818fb6001312d0daf33a61039d3acfcee7
-
SHA512
371d472067ee1c313ea37ff1bed16375446168ca95673ce1af2803e64e20c346de9932499622f256a6485a92c806f285be22ab8fed2726da5d73b4fae26fcf44
Malware Config
Extracted
qakbot
402.363
tr
1633334141
75.75.179.226:443
185.250.148.74:443
122.11.220.212:2222
120.150.218.241:995
103.148.120.144:443
140.82.49.12:443
40.131.140.155:995
206.47.134.234:2222
73.230.205.91:443
190.198.206.189:2222
103.157.122.198:995
81.250.153.227:2222
167.248.100.227:443
96.57.188.174:2078
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
136.232.34.70:443
68.186.192.69:443
167.248.111.245:443
81.241.252.59:2078
94.200.181.154:443
47.22.148.6:443
208.89.170.179:443
73.77.87.137:443
96.46.103.226:443
187.116.124.82:995
73.130.180.25:443
73.52.50.32:443
120.151.47.189:443
109.12.111.14:443
216.201.162.158:443
73.25.124.140:2222
181.118.183.94:443
174.54.58.170:443
24.152.219.253:995
124.123.42.115:2222
76.25.142.196:443
45.46.53.140:2222
37.210.152.224:995
173.21.10.71:2222
68.13.157.69:0
75.89.195.186:995
67.165.206.193:993
71.74.12.34:443
24.119.214.7:443
75.66.88.33:443
73.151.236.31:443
89.101.97.139:443
159.2.51.200:2222
78.191.36.142:995
75.188.35.168:443
95.77.223.148:443
105.198.236.99:443
110.174.64.179:995
47.40.196.233:2222
201.93.111.2:995
187.56.71.109:995
187.101.25.96:32100
174.54.193.186:443
86.8.177.143:443
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
24.139.72.117:443
72.252.201.69:443
68.117.229.117:443
167.248.117.81:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
167.248.99.149:443
68.204.7.158:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
69.30.186.190:443
72.196.22.184:443
167.248.23.224:443
98.22.92.139:995
209.50.20.255:443
97.98.130.50:443
196.117.75.181:995
77.57.204.78:443
191.191.38.8:443
176.251.215.116:443
96.46.103.109:2222
188.210.210.122:443
37.117.191.19:2222
90.197.155.33:443
197.90.137.161:61201
70.37.217.196:443
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
2.99.100.134:2222
217.17.56.163:443
39.52.236.68:995
71.190.231.182:443
62.23.194.38:443
62.23.194.41:995
173.25.166.81:443
199.27.127.129:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
217.165.163.21:995
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
5.238.148.193:61202
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 756 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\4cce23b1 = d19957d2e1967b5747e73b040272764fabea0aa7ee33bf5819bf8ea571469cece07743eb63102b85f8222e15611769775c9bd1f48d4edd7664431bfd4b08bf7706ae36818a9a3e0f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\c1ed949a = 55ddce1c604dd11b70632febeae4cdb5a1dd76989b38da3f4cc2673c8d7b372d9189265668b19e790ad7c57403149702f0d447f9ed1a348e22fecab21756d1c9cc18060ba31eec4a5601a9f6408d5a784b195cd7ddad60edda7f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\f47244d4 = 79e750f4d08dade90dc4efbfe87787bc93f8c1dd39000f7004c6c74b7a6401a35dc71866b8902bcd64bdbd7bfe0ec1207a072c63430133fda6c49715bc75e83dbcd6a8301a3818acf34542a96ea7358ace54f91bcc57267611c68ebb62b0331fdaf9cadcf4c8c7438608d5e2847fac1d9a1c213e95221e178faf84f8a19d01d8c9b7d19ada0013dd55f787070c506a5715f41e18 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\f63364a8 = cc3fcf7e5bb37147e2465625fcf6d8c3f2a1d6e27eef6ed3c8e380013a2c67a66d58c78f0bdef0d8b796c1b9f88eafb766873f121f230f7bd72d3eb47bce080037fa646445c0dac5c69ca839db4fd29555e04f1d0a263aecc23357d1f158e4d760ae explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\33874c47 = e8f71e2ebfd6253b80cab10df4a9b728baa6cbb38a62b6f1072dbc2fd170dfcbf4eb6ec844adb157acdc0e215edf explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\8b3b2b22 = bfabcf1cfc3c8a54451d10bc4c83cae44b991c70446b1a97bf35a4c21df4e8fc549255c0dab2065c170ca7d5de40e8c1394b73b0f84096c8a79490abfb4fbd70e6afcf65a74f37943c367a2cc43f11e7847948c1ab203c4ade7dab46211966ea667d99f3f6c700178c6ded92c55e24743814 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\bea4fb6c = 697496d06dc844b9d4e5000e4b4e531b8f558cb589632bb3ac5279f9f2e62c3ab3dc6f9103047429f8571e6e20d8611a62c80215a452d589ff explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Mevnfykuve explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\c1ed949a = 55ddd91c604de494ba62ae79ec234daad8353ea7c202857cf7e8de0d8046b5e231faf5f8272d510300abe93b681c0628f48745e04d9cff3e2c875329aa42aebd6ac0569b99 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Mevnfykuve\4e8f03cd = ca88630ebddf0e713af48c6fc1e3ecb7ff021bbc46af explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1596 rundll32.exe 756 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1596 rundll32.exe 756 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1540 wrote to memory of 1596 1540 rundll32.exe rundll32.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1488 1596 rundll32.exe explorer.exe PID 1488 wrote to memory of 796 1488 explorer.exe schtasks.exe PID 1488 wrote to memory of 796 1488 explorer.exe schtasks.exe PID 1488 wrote to memory of 796 1488 explorer.exe schtasks.exe PID 1488 wrote to memory of 796 1488 explorer.exe schtasks.exe PID 1800 wrote to memory of 1760 1800 taskeng.exe regsvr32.exe PID 1800 wrote to memory of 1760 1800 taskeng.exe regsvr32.exe PID 1800 wrote to memory of 1760 1800 taskeng.exe regsvr32.exe PID 1800 wrote to memory of 1760 1800 taskeng.exe regsvr32.exe PID 1800 wrote to memory of 1760 1800 taskeng.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 756 1760 regsvr32.exe regsvr32.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 756 wrote to memory of 1940 756 regsvr32.exe explorer.exe PID 1940 wrote to memory of 1324 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1324 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1324 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1324 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1680 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1680 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1680 1940 explorer.exe reg.exe PID 1940 wrote to memory of 1680 1940 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn phltlexj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 13:21 /ET 13:334⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {82EDBF16-47B3-4F70-B064-49EE136E2CB8} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ueyreylqomqi" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Invgxerfh" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
fa3ad164c7198e0bf3747ffa1f84d074
SHA1ebdd0932906db624c500d27184fa46814354756c
SHA2560c6a5acc3823fdd07d2096562030a3818fb6001312d0daf33a61039d3acfcee7
SHA512371d472067ee1c313ea37ff1bed16375446168ca95673ce1af2803e64e20c346de9932499622f256a6485a92c806f285be22ab8fed2726da5d73b4fae26fcf44
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
fa3ad164c7198e0bf3747ffa1f84d074
SHA1ebdd0932906db624c500d27184fa46814354756c
SHA2560c6a5acc3823fdd07d2096562030a3818fb6001312d0daf33a61039d3acfcee7
SHA512371d472067ee1c313ea37ff1bed16375446168ca95673ce1af2803e64e20c346de9932499622f256a6485a92c806f285be22ab8fed2726da5d73b4fae26fcf44
-
memory/756-69-0x0000000010000000-0x000000001458E000-memory.dmpFilesize
69.6MB
-
memory/756-68-0x0000000000C20000-0x0000000005157000-memory.dmpFilesize
69.2MB
-
memory/756-65-0x0000000000000000-mapping.dmp
-
memory/796-61-0x0000000000000000-mapping.dmp
-
memory/1324-75-0x0000000000000000-mapping.dmp
-
memory/1488-59-0x0000000074FE1000-0x0000000074FE3000-memory.dmpFilesize
8KB
-
memory/1488-60-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB
-
memory/1488-57-0x0000000000000000-mapping.dmp
-
memory/1596-53-0x0000000000000000-mapping.dmp
-
memory/1596-56-0x0000000010000000-0x000000001458E000-memory.dmpFilesize
69.6MB
-
memory/1596-55-0x00000000022D0000-0x0000000006807000-memory.dmpFilesize
69.2MB
-
memory/1596-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1680-76-0x0000000000000000-mapping.dmp
-
memory/1760-63-0x000007FEFC391000-0x000007FEFC393000-memory.dmpFilesize
8KB
-
memory/1760-62-0x0000000000000000-mapping.dmp
-
memory/1940-70-0x0000000000000000-mapping.dmp
-
memory/1940-74-0x0000000000390000-0x00000000003B1000-memory.dmpFilesize
132KB