Overview
overview
10Static
static
061dfb6a25...52.dll
windows7_x64
10061dfb6a25...52.dll
windows10_x64
1006d55f75d7...d2.dll
windows7_x64
1006d55f75d7...d2.dll
windows10_x64
1024401ac43b...65.dll
windows7_x64
124401ac43b...65.dll
windows10_x64
1260e2d5769...40.dll
windows7_x64
10260e2d5769...40.dll
windows10_x64
1026cd036960...18.dll
windows7_x64
1026cd036960...18.dll
windows10_x64
102a0a88a2e5...4a.dll
windows7_x64
102a0a88a2e5...4a.dll
windows10_x64
32f33217d51...94.dll
windows7_x64
102f33217d51...94.dll
windows10_x64
10336cdd146b...da.dll
windows7_x64
10336cdd146b...da.dll
windows10_x64
10417c1828d9...73.dll
windows7_x64
10417c1828d9...73.dll
windows10_x64
104d3095c796...ee.dll
windows7_x64
104d3095c796...ee.dll
windows10_x64
1054e526fe05...4c.dll
windows7_x64
154e526fe05...4c.dll
windows10_x64
16402b33d72...3b.dll
windows7_x64
106402b33d72...3b.dll
windows10_x64
1064c044cb3e...db.dll
windows7_x64
1064c044cb3e...db.dll
windows10_x64
10671f477c30...4e.dll
windows7_x64
10671f477c30...4e.dll
windows10_x64
1067785724b6...ce.dll
windows7_x64
167785724b6...ce.dll
windows10_x64
36c6934613a...fb.dll
windows7_x64
106c6934613a...fb.dll
windows10_x64
10Resubmissions
01-11-2021 12:31
211101-pp5r3ahha4 1031-10-2021 09:03
211031-k1bwxacfaq 1014-10-2021 01:44
211014-b6aflafeg4 10Analysis
-
max time kernel
145s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 01:44
Static task
static1
Behavioral task
behavioral1
Sample
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Resource
win10v20210408
Behavioral task
behavioral3
Sample
06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Resource
win7-en-20210920
Behavioral task
behavioral4
Sample
06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Resource
win10v20210408
Behavioral task
behavioral5
Sample
24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Resource
win7-en-20210920
Behavioral task
behavioral6
Sample
24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Resource
win10v20210408
Behavioral task
behavioral7
Sample
260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Resource
win10-en-20210920
Behavioral task
behavioral9
Sample
26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll
Resource
win7v20210408
Behavioral task
behavioral10
Sample
26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll
Resource
win10-en-20210920
Behavioral task
behavioral11
Sample
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll
Resource
win7v20210408
Behavioral task
behavioral12
Sample
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll
Resource
win10-en-20210920
Behavioral task
behavioral13
Sample
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Resource
win7v20210408
Behavioral task
behavioral14
Sample
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll
Resource
win7-en-20210920
Behavioral task
behavioral16
Sample
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll
Resource
win10v20210408
Behavioral task
behavioral17
Sample
417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Resource
win7-en-20210920
Behavioral task
behavioral18
Sample
417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Resource
win10v20210408
Behavioral task
behavioral19
Sample
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll
Resource
win7-en-20210920
Behavioral task
behavioral20
Sample
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll
Resource
win10v20210408
Behavioral task
behavioral21
Sample
54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Resource
win10-en-20210920
Behavioral task
behavioral23
Sample
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Resource
win7v20210408
Behavioral task
behavioral24
Sample
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Resource
win10-en-20210920
Behavioral task
behavioral25
Sample
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Resource
win7v20210408
Behavioral task
behavioral26
Sample
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Resource
win10-en-20210920
Behavioral task
behavioral27
Sample
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
Resource
win7v20210408
Behavioral task
behavioral28
Sample
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Resource
win7v20210408
Behavioral task
behavioral30
Sample
67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Resource
win7-en-20210920
Behavioral task
behavioral32
Sample
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Resource
win10v20210408
General
-
Target
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
-
Size
605KB
-
MD5
b166029cc6b11b16e9d29b22db5398df
-
SHA1
899238df1e045ed91034fc589e32ea9d19d0c09b
-
SHA256
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52
-
SHA512
aea6569743fc4d3d6180e93018e7a8184e4f657cc6807652840a48d9f269f534dc15072e94e27f28f40e6cedd65a0ecc4408db274b2a48854da38578ab500616
Malware Config
Extracted
qakbot
402.363
notset
1632819510
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1156 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1800 schtasks.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\7dd2996 = 6a46244a1e26bdf08a1496e81c2914 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\88bfbec1 = 94067bcbdd1e2faa878cc14b8441eee9117e8ce19b3c1c6b38376b351bf2389eb5a8a818897f8cf45930264095fcd12868f089a505f83b38ae9641fa6a70eabac19e0d072e38f886988ae12cd7007270d504f145e7c2da9db2a5da5234afd29770 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\f5b7f14b = 61034a70138e970b0acd32b68040e71aa49eee39c855a55ccb7641035a3acc3c6c85e7d87dcdcb5402154b72194bc5555d0e6703cca049b6331f6ef37f5f65552408d95a552e9ba933e5e5f9e0046ad97a7739b85ea1f6e9ea22f713526002f9e885 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\8afe9ebd = f45c7d77e5a738ca80641f2693ad384bb3bf18b6425e5dfbdab3c9fedbc79cfe32d8c3e16ab6e0322d84562fa25c5f8c83457b1868b613d7ec3c0591a244433cf065dfbf71f1a437738f5ac3 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\7dd2996 = 6a46334a1e26880ebdea0724a7716835960a01aa77d34dffc2b907ca459cd5af8945fa31 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Pelwaxryz explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\3242f9d8 = 0030fb5f6e62cf27f648468779a728b2c4bf68aec99dce96d21ce80745322b0adbb55ea022564f09aa48295efca5e5e1950dd54182669052fcb5df969891f75717a376c20a9fa9c632fdeb156d75fe229f55a6627bda976d7952ed86da0c14dcbfc955d35579b5504c9686a1e26e04a21645d8753ef3cdcb7965455e2287fdf4e2802b2085508cc2d4a4004435ff5993d09bd53eea3949988e0735f328a1adcd7957b0469108b0d26b9a68 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\3003d9a4 = e30d8c39b078f8deddc2e5e90081bbb94486dfc8831b3e68b9818cc6f8592a6dccd32386f463bf891e263fc4bea71bfd9569610c3f225bf018f24684caa8a70b14e8d63d6ef03b99615dc56f867bd8ec77b635eb1805819f8c432f73d2ae43c445d6a127d2 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\4d0b962e = 97aa42d486a79403bc49413b1ec5a2d0f8b4b4bc5b3adfa9dee5584ae33023abf66638b9732678b6b5bc5252015a9d4ad518c356cc272b76d93810affb5a39fe36bf65a652c06790a23e531e3d80235d330c7561b4d8e2e660dbe9adb20e8ac1c455343a6ee539a6779578e8bbffd8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Pelwaxryz\78944660 = f0099e910036681abc663500b17b699d7c1a669bda4f9c39169f9fbe4ac3d05bd93abc3beae11bf918ce8037f1badec3cb4f645bb0b3093ad53ac08f922a2ba638a8c26af2785c0947c4db257096a656 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 788 rundll32.exe 1156 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 788 rundll32.exe 1156 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 1540 wrote to memory of 788 1540 rundll32.exe 27 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 788 wrote to memory of 864 788 rundll32.exe 28 PID 864 wrote to memory of 1800 864 explorer.exe 29 PID 864 wrote to memory of 1800 864 explorer.exe 29 PID 864 wrote to memory of 1800 864 explorer.exe 29 PID 864 wrote to memory of 1800 864 explorer.exe 29 PID 1548 wrote to memory of 1588 1548 taskeng.exe 34 PID 1548 wrote to memory of 1588 1548 taskeng.exe 34 PID 1548 wrote to memory of 1588 1548 taskeng.exe 34 PID 1548 wrote to memory of 1588 1548 taskeng.exe 34 PID 1548 wrote to memory of 1588 1548 taskeng.exe 34 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1588 wrote to memory of 1156 1588 regsvr32.exe 35 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1156 wrote to memory of 1700 1156 regsvr32.exe 36 PID 1700 wrote to memory of 1112 1700 explorer.exe 37 PID 1700 wrote to memory of 1112 1700 explorer.exe 37 PID 1700 wrote to memory of 1112 1700 explorer.exe 37 PID 1700 wrote to memory of 1112 1700 explorer.exe 37 PID 1700 wrote to memory of 824 1700 explorer.exe 39 PID 1700 wrote to memory of 824 1700 explorer.exe 39 PID 1700 wrote to memory of 824 1700 explorer.exe 39 PID 1700 wrote to memory of 824 1700 explorer.exe 39
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xmntraxq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll\"" /SC ONCE /Z /ST 01:47 /ET 01:594⤵
- Creates scheduled task(s)
PID:1800
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A862BED1-A188-49E1-BCAB-C3D2C589D622} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lwcmhozflb" /d "0"5⤵PID:1112
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Auvqysxb" /d "0"5⤵PID:824
-
-
-
-