Analysis
-
max time kernel
126s -
max time network
23s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
07-10-2021 11:15
Static task
static1
Behavioral task
behavioral1
Sample
natu.html.dll
Resource
win7-en-20210920
General
-
Target
natu.html.dll
-
Size
611KB
-
MD5
22183f212d88c36f26d99a6b4a1fd336
-
SHA1
0c832c3517dc35df8e438d5b46d67f0231965d15
-
SHA256
359fae17b7c6b8c156c2030141189e5752f45fcaa91e9c649c99bbd3e220b19b
-
SHA512
5e444cbf5d9ea5820e611ac2288265763b0061f430532d8a97bb0f1c9567565877e3f682df3449cb786d2ac168143dd8b8373c2c71955dc2881857dfb24cbcc9
Malware Config
Extracted
qakbot
402.363
tr
1633597816
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
86.8.177.143:443
216.201.162.158:443
174.54.193.186:443
103.148.120.144:443
188.50.169.158:443
124.123.42.115:2222
140.82.49.12:443
199.27.127.129:443
81.241.252.59:2078
209.142.97.161:995
209.50.20.255:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
2.222.167.138:443
41.228.22.180:443
122.11.220.212:2222
78.191.58.219:995
47.22.148.6:443
74.72.237.54:443
217.17.56.163:465
96.57.188.174:2078
94.200.181.154:443
37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
45.46.53.140:2222
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
120.151.47.189:443
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1784 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\74c31211 = d788157065024607fd121cdb4cacb1b676c884870b8e6c7fddf870c12b3583e7b97680879b0e23 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\b8a7de7 = 984331348378c974a4d7c478250cc2d7db6dda3b00bc721f40fccb122bff9979c19636b6a68e33fe explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\3c548dd5 = 61ddac1380bb235d84c7752880b86e9e9100477d3771b431109a5c6cfff8a9c75ead4041c67f5b24a90b78c87d6f21f9e941ea99decd9ab298e4844dde9923f816fe5eb6a1feec explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\b8a7de7 = 984326348378fccbb71c4dac6af9acf6d17a85 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\3e15ada9 = e9895d132c8bcabbee9fd22e2904ff6168938051753a7531ac17f399cee62f7dc211bcaf954d35066d8ac1821b1dc038dd1dc480405016d65faa3c4998fc8b2208479b0b191f304a56d978bdea57dd9312f3379a26a8fe3edaf65a33f5107f3d2da033007f1414365bca7bc5ec90ca26860e98e8ab0b72c473ef02dc06649dcfe3a73c53bbbcfa5b8c7befdecc93968ad1d7fde120363fa8fb1567bb199011ff1db3470dcee0145b36981a728d520e627ce98b09dd5366c6285c7d9cf43336157762d2b92f8b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\84e8eab0 = c2863baec4373cabcc66a17cc76d3a9e9a16ed0b0c811b6fc3895583784d0cf61b688782411bf7eee41fddaa306b50db34 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\f9e0a53a = 054377fda076b992152bb764b86c565d8fc8e86ef0cdfab95572efcbab61048b5005e74837587ed15626b772bff7c102ba explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\415cc25f = 061e66cd61898a3185f6ccbf5bf9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Ajryrdflo\86a9cacc = 84d23a44ce7db2219fdfe57c0ea75426a176ea5884b13eb3b07cec8cc36f82230924c514e9d776767cde2fd12655aa938b9825b4d6d395ed1a8cd75b015f5284367e37ed15b240d04c75cea01644b3e9b386840dc5791c5fe1ec4e08524b3d73 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ajryrdflo explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1476 rundll32.exe 1784 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1476 rundll32.exe 1784 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1544 wrote to memory of 1476 1544 rundll32.exe rundll32.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 1476 wrote to memory of 964 1476 rundll32.exe explorer.exe PID 964 wrote to memory of 1112 964 explorer.exe schtasks.exe PID 964 wrote to memory of 1112 964 explorer.exe schtasks.exe PID 964 wrote to memory of 1112 964 explorer.exe schtasks.exe PID 964 wrote to memory of 1112 964 explorer.exe schtasks.exe PID 548 wrote to memory of 1792 548 taskeng.exe regsvr32.exe PID 548 wrote to memory of 1792 548 taskeng.exe regsvr32.exe PID 548 wrote to memory of 1792 548 taskeng.exe regsvr32.exe PID 548 wrote to memory of 1792 548 taskeng.exe regsvr32.exe PID 548 wrote to memory of 1792 548 taskeng.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1792 wrote to memory of 1784 1792 regsvr32.exe regsvr32.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 1784 wrote to memory of 832 1784 regsvr32.exe explorer.exe PID 832 wrote to memory of 1680 832 explorer.exe reg.exe PID 832 wrote to memory of 1680 832 explorer.exe reg.exe PID 832 wrote to memory of 1680 832 explorer.exe reg.exe PID 832 wrote to memory of 1680 832 explorer.exe reg.exe PID 832 wrote to memory of 628 832 explorer.exe reg.exe PID 832 wrote to memory of 628 832 explorer.exe reg.exe PID 832 wrote to memory of 628 832 explorer.exe reg.exe PID 832 wrote to memory of 628 832 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\natu.html.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\natu.html.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qxsnbmdv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\natu.html.dll\"" /SC ONCE /Z /ST 11:17 /ET 11:294⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {530BF5A4-FAE1-4DDC-8D08-2AAEA6DC0185} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\natu.html.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\natu.html.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Bujdjfatf" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nisbagjblpw" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\natu.html.dllMD5
22183f212d88c36f26d99a6b4a1fd336
SHA10c832c3517dc35df8e438d5b46d67f0231965d15
SHA256359fae17b7c6b8c156c2030141189e5752f45fcaa91e9c649c99bbd3e220b19b
SHA5125e444cbf5d9ea5820e611ac2288265763b0061f430532d8a97bb0f1c9567565877e3f682df3449cb786d2ac168143dd8b8373c2c71955dc2881857dfb24cbcc9
-
\Users\Admin\AppData\Local\Temp\natu.html.dllMD5
22183f212d88c36f26d99a6b4a1fd336
SHA10c832c3517dc35df8e438d5b46d67f0231965d15
SHA256359fae17b7c6b8c156c2030141189e5752f45fcaa91e9c649c99bbd3e220b19b
SHA5125e444cbf5d9ea5820e611ac2288265763b0061f430532d8a97bb0f1c9567565877e3f682df3449cb786d2ac168143dd8b8373c2c71955dc2881857dfb24cbcc9
-
memory/628-78-0x0000000000000000-mapping.dmp
-
memory/832-74-0x0000000000000000-mapping.dmp
-
memory/832-79-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/964-64-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/964-60-0x0000000000000000-mapping.dmp
-
memory/964-62-0x0000000074531000-0x0000000074533000-memory.dmpFilesize
8KB
-
memory/1112-63-0x0000000000000000-mapping.dmp
-
memory/1476-59-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1476-57-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1476-58-0x0000000000290000-0x00000000002B1000-memory.dmpFilesize
132KB
-
memory/1476-56-0x0000000000340000-0x00000000003DC000-memory.dmpFilesize
624KB
-
memory/1476-55-0x00000000751D1000-0x00000000751D3000-memory.dmpFilesize
8KB
-
memory/1476-54-0x0000000000000000-mapping.dmp
-
memory/1680-77-0x0000000000000000-mapping.dmp
-
memory/1784-71-0x00000000004D0000-0x000000000056C000-memory.dmpFilesize
624KB
-
memory/1784-73-0x0000000000940000-0x0000000000961000-memory.dmpFilesize
132KB
-
memory/1784-72-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1784-68-0x0000000000000000-mapping.dmp
-
memory/1792-66-0x000007FEFBA11000-0x000007FEFBA13000-memory.dmpFilesize
8KB
-
memory/1792-65-0x0000000000000000-mapping.dmp