Analysis
-
max time kernel
135s -
max time network
60s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-10-2021 16:51
Static task
static1
Behavioral task
behavioral1
Sample
44481.3965[2].dat.dll
Resource
win7v20210408
General
-
Target
44481.3965[2].dat.dll
-
Size
756KB
-
MD5
acdcd26de7e78893c0b6861316721469
-
SHA1
2f8716ea8f2747f7fdac054ec58644d6a3a175a4
-
SHA256
e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
-
SHA512
84c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
Malware Config
Extracted
qakbot
402.363
obama113
1634023197
73.52.50.32:443
167.248.117.81:443
209.236.35.178:443
67.230.44.194:443
72.173.78.211:443
146.66.238.74:443
181.118.183.94:443
94.200.181.154:443
81.250.153.227:2222
69.30.186.190:443
93.48.58.123:2222
136.232.34.70:443
103.142.10.177:443
185.250.148.74:443
174.54.193.186:443
39.49.64.244:995
89.137.52.44:443
77.31.162.93:443
24.107.165.50:443
73.230.205.91:443
140.82.49.12:443
197.89.12.119:443
120.151.47.189:443
75.131.217.182:443
41.86.42.158:995
200.232.214.222:995
103.148.120.144:443
124.123.42.115:2222
67.166.233.75:443
41.228.22.180:443
122.11.222.242:2222
85.109.229.54:995
217.17.56.163:2078
216.201.162.158:443
81.241.252.59:2078
120.150.218.241:995
220.255.25.28:2222
63.143.92.99:995
76.25.142.196:443
73.151.236.31:443
173.22.178.66:443
187.250.159.104:443
37.210.152.224:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:443
67.165.206.193:993
75.66.88.33:443
47.40.196.233:2222
89.101.97.139:443
201.68.60.118:995
188.55.245.223:995
109.12.111.14:443
45.46.53.140:2222
73.77.87.137:443
66.216.193.114:443
24.229.150.54:995
2.222.167.138:443
78.105.213.151:995
84.39.194.65:995
96.57.188.174:2078
72.252.201.69:995
81.213.59.22:443
68.204.7.158:443
73.207.119.14:443
105.198.236.99:443
182.181.67.141:995
68.117.61.91:2222
80.6.192.58:443
37.117.191.19:2222
24.119.214.7:443
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
121.52.154.80:995
186.32.163.199:443
181.4.53.6:465
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
199.27.127.129:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
27.223.92.142:995
99.227.243.24:993
187.172.230.218:443
24.139.72.117:443
189.54.223.244:995
47.22.148.6:443
98.157.235.126:443
2.99.100.134:2222
182.176.180.73:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
24.55.112.61:443
66.103.170.104:2222
209.142.97.161:995
74.72.237.54:443
66.177.215.152:50010
131.191.107.34:995
75.75.179.226:443
24.171.50.5:443
49.33.237.65:443
162.210.220.137:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
189.131.221.201:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
177.94.125.59:995
73.130.180.25:443
206.47.134.234:2222
208.89.171.42:443
167.248.54.34:2222
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 800 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Iuooschhaqz explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\e1a78cd3 = 7a49cd35469eb94ab67c05efc40f2b81f5565c420e1721b0f2de05f021266de568f497f7057289227d7ed579e1a1b28b68d348fbb8dd135603d9c69be3162f457def57508a98fe7c7fad29dfce0f759937d7fa78daaafcfbd77736ec8a5014b11fcacef0fad1b7b5101a709bfa4b2c6ea4036bd902a02e6203355eddf58b9e47c8b339852b914be100aee1e487c75ce42d8da23d1031a1450c3796a2ae871bb734f5bf64e40d13efcf06aa4c56b109e3bcc4d597ddd7bcad2fa3ce564ed66cfa53ce8c43bc901de8a51fbf33 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\e3e6acaf = 5f36fd2644e76fda1b51be491f8b66ad9953c9f4d9a699fdb0875df6b88935275544b8db74c2 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\5b5acbca = 7e41c10d37e24e0322b2fcffcfc6a2b7ca051f7b277d60796ab3163e8ce1f93761954f434632146fa26ea9d078a1da3f871b0f030fe144d30fef8fa52159336b0789566d89a71ab9a3ad156c8f54682321103fd84b3378355cb8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\26528440 = 5430881149f12bfc2adb2f017956b74e123c36fc3d1df965a73724efdec594ec45150aca4b1595fed7267d36844f397473fa4a6efc9f2a217f12ea817fd82266b944a2b6be explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\d4385c9d = 267f1130edba21eac4278cf636c064ab7e029c5f7ecd6d8a19444927d0adb27497f6a052b21940b5f75b41266e454c explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\d4385c9d = 267f0630edba142c92bcf8e0b891912b9be4deec7f3048654602 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\9eeee325 = 08e4d8ae5eae2112275fbd33784c8d68b437bad0a7f9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\591bebb6 = eb3da744838dd7f84700f0fd428edf4844ab95b4fe11131c0366c261492a29 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Iuooschhaqz\ab71336b = bdef4b788bc7a7e87ab1acd601f8fc0274574f354ee887979bbd565eda522f6aa8548b1614a90a257e17c01400cc963b5381b4cbf9e7541c97fc2fcb4832a99a766e8f11acf18dce46e60e8a5d7a88c1f28eaf1daa0c68 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1308 rundll32.exe 800 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1308 rundll32.exe 800 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1308 1988 rundll32.exe rundll32.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1308 wrote to memory of 1964 1308 rundll32.exe explorer.exe PID 1964 wrote to memory of 1708 1964 explorer.exe schtasks.exe PID 1964 wrote to memory of 1708 1964 explorer.exe schtasks.exe PID 1964 wrote to memory of 1708 1964 explorer.exe schtasks.exe PID 1964 wrote to memory of 1708 1964 explorer.exe schtasks.exe PID 672 wrote to memory of 1808 672 taskeng.exe regsvr32.exe PID 672 wrote to memory of 1808 672 taskeng.exe regsvr32.exe PID 672 wrote to memory of 1808 672 taskeng.exe regsvr32.exe PID 672 wrote to memory of 1808 672 taskeng.exe regsvr32.exe PID 672 wrote to memory of 1808 672 taskeng.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 1808 wrote to memory of 800 1808 regsvr32.exe regsvr32.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 800 wrote to memory of 588 800 regsvr32.exe explorer.exe PID 588 wrote to memory of 1332 588 explorer.exe reg.exe PID 588 wrote to memory of 1332 588 explorer.exe reg.exe PID 588 wrote to memory of 1332 588 explorer.exe reg.exe PID 588 wrote to memory of 1332 588 explorer.exe reg.exe PID 588 wrote to memory of 916 588 explorer.exe reg.exe PID 588 wrote to memory of 916 588 explorer.exe reg.exe PID 588 wrote to memory of 916 588 explorer.exe reg.exe PID 588 wrote to memory of 916 588 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rhhcocoy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dll\"" /SC ONCE /Z /ST 18:53 /ET 19:054⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {148CB617-5C04-40AF-803A-F87F8FAC13C6} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fpvzqxtfbykw" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Qeahofeolvrv" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
\Users\Admin\AppData\Local\Temp\44481.3965[2].dat.dllMD5
acdcd26de7e78893c0b6861316721469
SHA12f8716ea8f2747f7fdac054ec58644d6a3a175a4
SHA256e7e9ac9bbc69589e627f913f8605938b96afd929ebc974ffa0955598d19498d1
SHA51284c29ce85551beda34e86c56da1d0a2a97f080b0073de679183eb5a1493c3a2bd760d414526f43643ec9689a3a010ed357e9428d4bd18c08cc664c9903f00aa7
-
memory/588-94-0x0000000000310000-0x0000000000331000-memory.dmpFilesize
132KB
-
memory/588-89-0x0000000000000000-mapping.dmp
-
memory/800-87-0x00000000003C0000-0x00000000003E1000-memory.dmpFilesize
132KB
-
memory/800-86-0x00000000003C0000-0x00000000003E1000-memory.dmpFilesize
132KB
-
memory/800-85-0x00000000003C0000-0x00000000003E1000-memory.dmpFilesize
132KB
-
memory/800-83-0x00000000003C0000-0x00000000003E1000-memory.dmpFilesize
132KB
-
memory/800-84-0x00000000003C0000-0x00000000003E1000-memory.dmpFilesize
132KB
-
memory/800-82-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/800-79-0x0000000000000000-mapping.dmp
-
memory/916-93-0x0000000000000000-mapping.dmp
-
memory/1308-68-0x00000000002F0000-0x000000000032B000-memory.dmpFilesize
236KB
-
memory/1308-65-0x0000000000620000-0x0000000000641000-memory.dmpFilesize
132KB
-
memory/1308-61-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1308-63-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1308-64-0x0000000000620000-0x0000000000641000-memory.dmpFilesize
132KB
-
memory/1308-66-0x0000000000620000-0x0000000000641000-memory.dmpFilesize
132KB
-
memory/1308-67-0x0000000000620000-0x0000000000641000-memory.dmpFilesize
132KB
-
memory/1308-60-0x0000000000000000-mapping.dmp
-
memory/1308-69-0x0000000000620000-0x0000000000641000-memory.dmpFilesize
132KB
-
memory/1332-92-0x0000000000000000-mapping.dmp
-
memory/1708-74-0x0000000000000000-mapping.dmp
-
memory/1808-77-0x000007FEFC391000-0x000007FEFC393000-memory.dmpFilesize
8KB
-
memory/1808-76-0x0000000000000000-mapping.dmp
-
memory/1964-70-0x0000000000340000-0x0000000000342000-memory.dmpFilesize
8KB
-
memory/1964-71-0x0000000000000000-mapping.dmp
-
memory/1964-73-0x0000000074EB1000-0x0000000074EB3000-memory.dmpFilesize
8KB
-
memory/1964-75-0x0000000000310000-0x0000000000331000-memory.dmpFilesize
132KB