ocrafh.html
ocrafh.html.dll
819KB
12-10-2021 13:08
2897721785645ad5b2a8fb524ed650c0
d836fa75f0682b4c393418231aefca97169d551e
956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85
Extracted
Family | qakbot |
Version | 402.363 |
Botnet | tr |
Campaign | 1633597626 |
C2 |
120.150.218.241:995 185.250.148.74:443 89.137.52.44:443 66.103.170.104:2222 86.8.177.143:443 216.201.162.158:443 174.54.193.186:443 103.148.120.144:443 188.50.169.158:443 124.123.42.115:2222 140.82.49.12:443 199.27.127.129:443 81.241.252.59:2078 209.142.97.161:995 209.50.20.255:443 73.230.205.91:443 200.232.214.222:995 103.142.10.177:443 2.222.167.138:443 41.228.22.180:443 122.11.220.212:2222 78.191.58.219:995 47.22.148.6:443 74.72.237.54:443 217.17.56.163:465 96.57.188.174:2078 94.200.181.154:443 37.210.152.224:995 201.93.111.2:995 202.134.178.157:443 89.101.97.139:443 73.52.50.32:443 188.55.235.110:995 27.223.92.142:995 181.118.183.94:443 136.232.34.70:443 186.32.163.199:443 72.173.78.211:443 76.25.142.196:443 45.46.53.140:2222 98.157.235.126:443 173.21.10.71:2222 73.151.236.31:443 71.74.12.34:443 75.75.179.226:443 167.248.117.81:443 67.165.206.193:993 47.40.196.233:2222 72.252.201.69:443 181.4.53.6:465 |
Filter: none
-
Qakbot/Qbot
Description
Qbot or Qakbot is a sophisticated worm with banking capabilities.
Tags
-
Loads dropped DLLregsvr32.exe
Reported IOCs
pid process 2124 regsvr32.exe -
Creates scheduled task(s)schtasks.exe
Description
Schtasks is often used by malware for persistence or to perform post-infection execution.
Tags
TTPs
Reported IOCs
pid process 3600 schtasks.exe -
Suspicious behavior: EnumeratesProcessesrundll32.exe
Reported IOCs
pid process 3156 rundll32.exe 3156 rundll32.exe -
Suspicious behavior: MapViewOfSectionrundll32.exe
Reported IOCs
pid process 3156 rundll32.exe -
Suspicious use of WriteProcessMemoryrundll32.exerundll32.exeexplorer.exeregsvr32.exe
Reported IOCs
description pid process target process PID 532 wrote to memory of 3156 532 rundll32.exe rundll32.exe PID 532 wrote to memory of 3156 532 rundll32.exe rundll32.exe PID 532 wrote to memory of 3156 532 rundll32.exe rundll32.exe PID 3156 wrote to memory of 3016 3156 rundll32.exe explorer.exe PID 3156 wrote to memory of 3016 3156 rundll32.exe explorer.exe PID 3156 wrote to memory of 3016 3156 rundll32.exe explorer.exe PID 3156 wrote to memory of 3016 3156 rundll32.exe explorer.exe PID 3156 wrote to memory of 3016 3156 rundll32.exe explorer.exe PID 3016 wrote to memory of 3600 3016 explorer.exe schtasks.exe PID 3016 wrote to memory of 3600 3016 explorer.exe schtasks.exe PID 3016 wrote to memory of 3600 3016 explorer.exe schtasks.exe PID 2004 wrote to memory of 2124 2004 regsvr32.exe regsvr32.exe PID 2004 wrote to memory of 2124 2004 regsvr32.exe regsvr32.exe PID 2004 wrote to memory of 2124 2004 regsvr32.exe regsvr32.exe
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll,#1Suspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exeSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aernstdhol /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll\"" /SC ONCE /Z /ST 20:24 /ET 20:36Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll"Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll
MD52897721785645ad5b2a8fb524ed650c0
SHA1d836fa75f0682b4c393418231aefca97169d551e
SHA256956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85
SHA512f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a
-
\Users\Admin\AppData\Local\Temp\ocrafh.html.dll
MD52897721785645ad5b2a8fb524ed650c0
SHA1d836fa75f0682b4c393418231aefca97169d551e
SHA256956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85
SHA512f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a
-
memory/2124-125-0x0000000000000000-mapping.dmp
-
memory/3016-123-0x0000000000160000-0x0000000000161000-memory.dmp
-
memory/3016-122-0x0000000000160000-0x0000000000161000-memory.dmp
-
memory/3016-119-0x0000000000000000-mapping.dmp
-
memory/3016-120-0x0000000000960000-0x0000000000981000-memory.dmp
-
memory/3156-118-0x00000000034F0000-0x00000000034F1000-memory.dmp
-
memory/3156-116-0x0000000074240000-0x0000000074261000-memory.dmp
-
memory/3156-117-0x0000000074240000-0x00000000743B1000-memory.dmp
-
memory/3156-115-0x0000000074240000-0x00000000743B1000-memory.dmp
-
memory/3156-114-0x0000000000000000-mapping.dmp
-
memory/3600-121-0x0000000000000000-mapping.dmp