Analysis
-
max time kernel
127s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
12-10-2021 14:18
Static task
static1
Behavioral task
behavioral1
Sample
44481.6902336806.dat.dll
Resource
win7-en-20210920
General
-
Target
44481.6902336806.dat.dll
-
Size
756KB
-
MD5
acdcd26de7e78893c0b6861316721469
-
SHA1
2f8716ea8f2747f7fdac054ec58644d6a3a175a4
-
SHA256
e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
-
SHA512
84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
Malware Config
Extracted
qakbot
402.363
obama113
1634023197
73.52.50.32:443
167.248.117.81:443
209.236.35.178:443
67.230.44.194:443
72.173.78.211:443
146.66.238.74:443
181.118.183.94:443
94.200.181.154:443
81.250.153.227:2222
69.30.186.190:443
93.48.58.123:2222
136.232.34.70:443
103.142.10.177:443
185.250.148.74:443
174.54.193.186:443
39.49.64.244:995
89.137.52.44:443
77.31.162.93:443
24.107.165.50:443
73.230.205.91:443
140.82.49.12:443
197.89.12.119:443
120.151.47.189:443
75.131.217.182:443
41.86.42.158:995
200.232.214.222:995
103.148.120.144:443
124.123.42.115:2222
67.166.233.75:443
41.228.22.180:443
122.11.222.242:2222
85.109.229.54:995
217.17.56.163:2078
216.201.162.158:443
81.241.252.59:2078
120.150.218.241:995
220.255.25.28:2222
63.143.92.99:995
76.25.142.196:443
73.151.236.31:443
173.22.178.66:443
187.250.159.104:443
37.210.152.224:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:443
67.165.206.193:993
75.66.88.33:443
47.40.196.233:2222
89.101.97.139:443
201.68.60.118:995
188.55.245.223:995
109.12.111.14:443
45.46.53.140:2222
73.77.87.137:443
66.216.193.114:443
24.229.150.54:995
2.222.167.138:443
78.105.213.151:995
84.39.194.65:995
96.57.188.174:2078
72.252.201.69:995
81.213.59.22:443
68.204.7.158:443
73.207.119.14:443
105.198.236.99:443
182.181.67.141:995
68.117.61.91:2222
80.6.192.58:443
37.117.191.19:2222
24.119.214.7:443
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
121.52.154.80:995
186.32.163.199:443
181.4.53.6:465
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
199.27.127.129:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
27.223.92.142:995
99.227.243.24:993
187.172.230.218:443
24.139.72.117:443
189.54.223.244:995
47.22.148.6:443
98.157.235.126:443
2.99.100.134:2222
182.176.180.73:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
24.55.112.61:443
66.103.170.104:2222
209.142.97.161:995
74.72.237.54:443
66.177.215.152:50010
131.191.107.34:995
75.75.179.226:443
24.171.50.5:443
49.33.237.65:443
162.210.220.137:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
189.131.221.201:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
177.94.125.59:995
73.130.180.25:443
206.47.134.234:2222
208.89.171.42:443
167.248.54.34:2222
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1320 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\b6dda77 = aa5670c3233d23ba3cd4d66fe52f40cf6fa3f92564afdaf1311517204f5c4f3fcc522fd4b5f5a227dfa1dfd58a054b50858eb958aa9fddc283b132c2a14c33e2a1fd1417df143f9dcaec7f09216d0107a4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\ced9f298 = 1dfee2f63996d30d52a5c78ccb5941d8b6377ea7b69ed18e5cb50cc387ab86fb60398acb6017dafaa6e73b60b596496bd8f9f34f81ba96bc6aba305162885776122307cbbb9e6a3d56fbb8238092866063f578e4465dbbfd26e851eabd047a9fd7e35830d267e17de9a37d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\766595fd = 1c8e3c9a46805ba94ab546400e3d974d21c01422f28da8e22bcd7363f5c5fd7c8fb3b4619f0037bab7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\b1909d6e = a56364f22e4d25612187949a423a76d17e0c4bbf0b6a01 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Gkellmub explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\3cb32a45 = 7ed98b7d15958a299700688773498d207030d68fef75ddf23c9fc9ee8abfd9cf4d5f58b92f304fd1996da9b2950149dc2ccdf54e0e6d59bc27a1ec66bdb5e20bb8055cbafbbd5ea89e19c445277c explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\43fa45b3 = 2974c31876f3394a7fc7e99c322fe1542da3f360a8d705d2b25806f47f4b486d603bebfb5a50bcf250b4793a2a815ad3ee5d0226fb5fce4fee84d5047894ce07f1e555c7685bcfa42c5c01dca2c21cee75135cac9df773a95b72d7c7f85cb973e641 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\3cb32a45 = 7ed99c7d1595bf03a78ca65b8110cf2134b9d814da08af495f6fc1ff9ce5f91f45bf937b8bc089682c40a286bf118d593af8cc910d36a90fd8cb54e321dd65b25b29a59c4b01a792f4aeb3b9884cf845b731fc5e39938b2372d81a166e38348a511394 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\92cfa0b = 5f3370a0c4f923f9fe240013304c04d16a9f4890fdce21688035c427fb30cc3c9542f48974177dfe17718d5ae19cc4c1dbd5b299b3f46872c36a4ee60dd80fd39b785f1cb04e25c2a28f89cbc585fd2fbd361b10cbc0c89f82ef650b28b77cd96f7809d23201e830a1783712239690ec5f38169a3e9083311f28fd8245c75e52d2596077e98bd5a354b723f9e4e6b26bb6bcd7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Gkellmub\b3d1bd12 = 479ba6b0403e78808855b3a1d3bdf29efef4b64d4d6463d282799b7996e95696e845064e76b7677f9430d687d45742ea34c028 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 952 rundll32.exe 1320 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 952 rundll32.exe 1320 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 1324 wrote to memory of 952 1324 rundll32.exe rundll32.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 952 wrote to memory of 864 952 rundll32.exe explorer.exe PID 864 wrote to memory of 1496 864 explorer.exe schtasks.exe PID 864 wrote to memory of 1496 864 explorer.exe schtasks.exe PID 864 wrote to memory of 1496 864 explorer.exe schtasks.exe PID 864 wrote to memory of 1496 864 explorer.exe schtasks.exe PID 1060 wrote to memory of 1580 1060 taskeng.exe regsvr32.exe PID 1060 wrote to memory of 1580 1060 taskeng.exe regsvr32.exe PID 1060 wrote to memory of 1580 1060 taskeng.exe regsvr32.exe PID 1060 wrote to memory of 1580 1060 taskeng.exe regsvr32.exe PID 1060 wrote to memory of 1580 1060 taskeng.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe regsvr32.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1320 wrote to memory of 1704 1320 regsvr32.exe explorer.exe PID 1704 wrote to memory of 1428 1704 explorer.exe reg.exe PID 1704 wrote to memory of 1428 1704 explorer.exe reg.exe PID 1704 wrote to memory of 1428 1704 explorer.exe reg.exe PID 1704 wrote to memory of 1428 1704 explorer.exe reg.exe PID 1704 wrote to memory of 816 1704 explorer.exe reg.exe PID 1704 wrote to memory of 816 1704 explorer.exe reg.exe PID 1704 wrote to memory of 816 1704 explorer.exe reg.exe PID 1704 wrote to memory of 816 1704 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jjmwutvw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll\"" /SC ONCE /Z /ST 14:20 /ET 14:324⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C366AD48-DA1C-41DF-8F73-B5A69D2DD5F7} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hurifvtp" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nfavsuxygwu" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
memory/816-89-0x0000000000000000-mapping.dmp
-
memory/864-64-0x0000000000130000-0x0000000000132000-memory.dmpFilesize
8KB
-
memory/864-69-0x0000000000100000-0x0000000000121000-memory.dmpFilesize
132KB
-
memory/864-67-0x00000000749E1000-0x00000000749E3000-memory.dmpFilesize
8KB
-
memory/864-65-0x0000000000000000-mapping.dmp
-
memory/952-59-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/952-62-0x00000000003E0000-0x000000000041B000-memory.dmpFilesize
236KB
-
memory/952-63-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/952-60-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/952-61-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/952-58-0x0000000000430000-0x0000000000451000-memory.dmpFilesize
132KB
-
memory/952-57-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/952-56-0x00000000004E0000-0x00000000005A1000-memory.dmpFilesize
772KB
-
memory/952-54-0x0000000000000000-mapping.dmp
-
memory/952-55-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1320-81-0x0000000000E40000-0x0000000000E61000-memory.dmpFilesize
132KB
-
memory/1320-80-0x0000000000E40000-0x0000000000E61000-memory.dmpFilesize
132KB
-
memory/1320-76-0x0000000000860000-0x0000000000921000-memory.dmpFilesize
772KB
-
memory/1320-77-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1320-79-0x0000000000E40000-0x0000000000E61000-memory.dmpFilesize
132KB
-
memory/1320-78-0x0000000000E40000-0x0000000000E61000-memory.dmpFilesize
132KB
-
memory/1320-82-0x0000000000E40000-0x0000000000E61000-memory.dmpFilesize
132KB
-
memory/1320-73-0x0000000000000000-mapping.dmp
-
memory/1428-88-0x0000000000000000-mapping.dmp
-
memory/1496-68-0x0000000000000000-mapping.dmp
-
memory/1580-71-0x000007FEFC051000-0x000007FEFC053000-memory.dmpFilesize
8KB
-
memory/1580-70-0x0000000000000000-mapping.dmp
-
memory/1704-84-0x0000000000000000-mapping.dmp
-
memory/1704-90-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB