Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-10-2021 14:24
Static task
static1
Behavioral task
behavioral1
Sample
44481.6902336806.dat.dll
Resource
win7v20210408
General
-
Target
44481.6902336806.dat.dll
-
Size
756KB
-
MD5
acdcd26de7e78893c0b6861316721469
-
SHA1
2f8716ea8f2747f7fdac054ec58644d6a3a175a4
-
SHA256
e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
-
SHA512
84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
Malware Config
Extracted
qakbot
402.363
obama113
1634023197
73.52.50.32:443
167.248.117.81:443
209.236.35.178:443
67.230.44.194:443
72.173.78.211:443
146.66.238.74:443
181.118.183.94:443
94.200.181.154:443
81.250.153.227:2222
69.30.186.190:443
93.48.58.123:2222
136.232.34.70:443
103.142.10.177:443
185.250.148.74:443
174.54.193.186:443
39.49.64.244:995
89.137.52.44:443
77.31.162.93:443
24.107.165.50:443
73.230.205.91:443
140.82.49.12:443
197.89.12.119:443
120.151.47.189:443
75.131.217.182:443
41.86.42.158:995
200.232.214.222:995
103.148.120.144:443
124.123.42.115:2222
67.166.233.75:443
41.228.22.180:443
122.11.222.242:2222
85.109.229.54:995
217.17.56.163:2078
216.201.162.158:443
81.241.252.59:2078
120.150.218.241:995
220.255.25.28:2222
63.143.92.99:995
76.25.142.196:443
73.151.236.31:443
173.22.178.66:443
187.250.159.104:443
37.210.152.224:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:443
67.165.206.193:993
75.66.88.33:443
47.40.196.233:2222
89.101.97.139:443
201.68.60.118:995
188.55.245.223:995
109.12.111.14:443
45.46.53.140:2222
73.77.87.137:443
66.216.193.114:443
24.229.150.54:995
2.222.167.138:443
78.105.213.151:995
84.39.194.65:995
96.57.188.174:2078
72.252.201.69:995
81.213.59.22:443
68.204.7.158:443
73.207.119.14:443
105.198.236.99:443
182.181.67.141:995
68.117.61.91:2222
80.6.192.58:443
37.117.191.19:2222
24.119.214.7:443
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
121.52.154.80:995
186.32.163.199:443
181.4.53.6:465
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
199.27.127.129:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
27.223.92.142:995
99.227.243.24:993
187.172.230.218:443
24.139.72.117:443
189.54.223.244:995
47.22.148.6:443
98.157.235.126:443
2.99.100.134:2222
182.176.180.73:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
24.55.112.61:443
66.103.170.104:2222
209.142.97.161:995
74.72.237.54:443
66.177.215.152:50010
131.191.107.34:995
75.75.179.226:443
24.171.50.5:443
49.33.237.65:443
162.210.220.137:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
189.131.221.201:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
177.94.125.59:995
73.130.180.25:443
206.47.134.234:2222
208.89.171.42:443
167.248.54.34:2222
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1144 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\67b92205 = 33428e26c670a8b7e66f8c3444a21dd9cfa1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\5067d237 = 54b1670d5bdf3d163f60a0ed3bae2c46d26631e4adcf805e2001aac9ab81eee93aacf50c6cb782b568624e1d07b4b0768fd515cecd3b8c71d4f7c45e29042c57b5fc856af028d5a767597982aeec16c37a3743a3e6186b8248ad3dad09 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\e8dbb552 = 44debcb034a9b9e0e784a1d2a4d22701fccd04e3f9e6fe02c067d949a3eb251b56fdeab253e576e95b5287b96d0f78d91318141c9aafe700c1ef06f01972f612ca9821b014ad622fb6bed31c99471e4809bcbad5c13075db explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\95d3fad8 = 107b32ce875f33c419f5d5245f2c3ac9b1b5a2cf81b4c791 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\2d6f9dbd = 20dd4a1bfd42a0869048223dc1bd8a5d89c9a8d7c30f79d09fed6812e8564cdd55437f6f90443f125db4dc37a42febb07a84e70fd484cd180ee37f3b6ad9032c63ebdc9c85b62ee1631663bca4bcd9f6c558a5722aff3b80d4d1ca7bd377643eaf4d360a7aa07058d1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\ea9a952e = 312e44962d582f15e4ba805cb0ad828358c5183ab4edf0c9e85ca7ef0e7eb5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\18f04df3 = 9a85fb52c0d882f53cc30112b8c2fa1dfc7bff9244e7862a54e894f635f5013d39217b explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Neqeznsee explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\5226f24b = 8437907f1e335c4bb03c4431ec5c4b2d8d5c24eea3e843f39171ce81a98823b041fe0250774d5920b5141b5a08abc55aed67f2034e0425c03f7806b87ac48aba9c6ee2fbc8c180d06bfda679c9c6c5a1a0b2b6ed1e457555d957c33713312e757cd8ea5bdb5b629fe2674cf96982340b6f9e74d46bdd86dd43a8030b79fa9afe49df60c9e1654f1cb9fced3dc2b51f30 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Neqeznsee\67b92205 = 33429926c6709dda07c64a9c3f9e34d7bf7f6550b4f6b36244a32360bcc3d6b1a34b6f9236dfbf explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2004 rundll32.exe 1144 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2004 rundll32.exe 1144 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 1652 wrote to memory of 2004 1652 rundll32.exe rundll32.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 2004 wrote to memory of 1968 2004 rundll32.exe explorer.exe PID 1968 wrote to memory of 1832 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1832 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1832 1968 explorer.exe schtasks.exe PID 1968 wrote to memory of 1832 1968 explorer.exe schtasks.exe PID 1468 wrote to memory of 1728 1468 taskeng.exe regsvr32.exe PID 1468 wrote to memory of 1728 1468 taskeng.exe regsvr32.exe PID 1468 wrote to memory of 1728 1468 taskeng.exe regsvr32.exe PID 1468 wrote to memory of 1728 1468 taskeng.exe regsvr32.exe PID 1468 wrote to memory of 1728 1468 taskeng.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1144 1728 regsvr32.exe regsvr32.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 1144 wrote to memory of 924 1144 regsvr32.exe explorer.exe PID 924 wrote to memory of 296 924 explorer.exe reg.exe PID 924 wrote to memory of 296 924 explorer.exe reg.exe PID 924 wrote to memory of 296 924 explorer.exe reg.exe PID 924 wrote to memory of 296 924 explorer.exe reg.exe PID 924 wrote to memory of 944 924 explorer.exe reg.exe PID 924 wrote to memory of 944 924 explorer.exe reg.exe PID 924 wrote to memory of 944 924 explorer.exe reg.exe PID 924 wrote to memory of 944 924 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xtwhnzjcfs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll\"" /SC ONCE /Z /ST 16:26 /ET 16:384⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {7B603999-D4D0-474B-B778-3A22C3935BEC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ksxtas" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Aqcvslwi" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\44481.6902336806.dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
memory/296-93-0x0000000000000000-mapping.dmp
-
memory/924-89-0x0000000000000000-mapping.dmp
-
memory/924-96-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/944-94-0x0000000000000000-mapping.dmp
-
memory/1144-87-0x00000000003F0000-0x0000000000411000-memory.dmpFilesize
132KB
-
memory/1144-86-0x00000000003F0000-0x0000000000411000-memory.dmpFilesize
132KB
-
memory/1144-84-0x00000000003F0000-0x0000000000411000-memory.dmpFilesize
132KB
-
memory/1144-85-0x00000000003F0000-0x0000000000411000-memory.dmpFilesize
132KB
-
memory/1144-83-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1144-82-0x0000000000A30000-0x0000000000AF1000-memory.dmpFilesize
772KB
-
memory/1144-95-0x00000000003F0000-0x0000000000411000-memory.dmpFilesize
132KB
-
memory/1144-79-0x0000000000000000-mapping.dmp
-
memory/1728-77-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB
-
memory/1728-76-0x0000000000000000-mapping.dmp
-
memory/1832-75-0x0000000000000000-mapping.dmp
-
memory/1968-11-0x0000000074A01000-0x0000000074A03000-memory.dmpFilesize
8KB
-
memory/1968-74-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1968-8-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1968-9-0x0000000000000000-mapping.dmp
-
memory/2004-72-0x0000000000260000-0x000000000029B000-memory.dmpFilesize
236KB
-
memory/2004-73-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/2004-0-0x0000000000000000-mapping.dmp
-
memory/2004-6-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/2004-7-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/2004-5-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/2004-4-0x0000000000830000-0x0000000000851000-memory.dmpFilesize
132KB
-
memory/2004-3-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/2004-2-0x0000000000730000-0x00000000007F1000-memory.dmpFilesize
772KB
-
memory/2004-1-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB