Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 22:19
Static task
static1
Behavioral task
behavioral1
Sample
450184.dll
Resource
win7-en-20210920
General
-
Target
450184.dll
-
Size
131KB
-
MD5
9ce1e32e3d046f8d48fdd17f49d7a3da
-
SHA1
e0cd269248501022f9cf8cd31b678e039cb029d1
-
SHA256
31115320c06d44714df32b4c26f33a8e14396f97ad46433cd30ec3eee01b2750
-
SHA512
6c8d0bce56f282d235df8715d5d46ff1e020f8293ce3e1b0053515a6d6527e97a626d5395273a7d2fb251717cae840dc99878794a42f2964db7cbafd66e29232
Malware Config
Extracted
qakbot
402.363
domain01
1632765151
173.21.10.71:2222
67.165.206.193:993
37.210.152.224:995
68.204.7.158:443
89.101.97.139:443
47.22.148.6:443
120.151.47.189:443
47.40.196.233:2222
24.229.150.54:995
81.250.153.227:2222
76.25.142.196:443
71.74.12.34:443
181.118.183.94:443
24.55.112.61:443
24.139.72.117:443
120.150.218.241:995
185.250.148.74:443
109.12.111.14:443
140.82.49.12:443
177.130.82.197:2222
72.252.201.69:443
187.156.138.172:443
95.77.223.148:443
71.80.168.245:443
81.241.252.59:2078
45.46.53.140:2222
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
136.232.34.70:443
105.198.236.99:443
103.148.120.144:443
27.223.92.142:995
73.151.236.31:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 432 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\ac389053 = 9b21379690a911d02149a5d1035f9f3211f8c46e3e800d7a9cf004998551f3b2e8c2ae895545e25239c77545c1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\99a7401d = 6d356f13225111a856d8ad948c6f7c114218 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\e6ee2feb = 64e09371f856c9f232abe21b612b1e87653d701b3941e16e97af3af8b28c68f465e5ad6ee204c1e63d520b0f905414cd3b62237e4b553762555daf7c6499db899e10facd3ffc8c69f535281656f8505796fe7044ec explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\d130dfd9 = 79ba0f2ac78353c1c70a71b5566c1dd13f33ebf295559523a69b0612705e295582d58f566104edb25e101a3fcc683cf7f9a5ddcf65871b4e0365ff5593f737dc03e621d9ddffddafbf8d793e4b5a7edd1e05349c17 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\1484f736 = c8b867607d56d264527aa38bd9f968b7cfb31b780d53696b238e41cc1197814082effbec9c81bbc3e09c2ab70590 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\6bcd98c0 = 03abfe96fd0d49379aa9cc3dea3af65ee610b0256f7c6562a48c5ca55631da702b73a88c4df12dc1efe5f803430062435c258fc9085c84ce63e6396cdc2a77fd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\e6ee2feb = 64e08471f856fcf21f1733ebb874922cb9697782bdc34f2668d1d2a5e9900c180cdd52e9305411ad2e827cb4d6b1eed3ff94de14749b537fd441a4a40ac92542c78fdb4ee53a0df4f83277cd345636e962441a6f9349a68ef7d2758a213eb6d28a52b473834f6189f791 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\d371ffa5 = e51e7ebd028dc72c68ad935eb4e9f83836092c726e6eed71fccf711d11d728b373d3774736da2c0894ed4fb1741ef2366887ab4732103015a39f6fd24ed83c5a21e6ae1ad49576b8703b5067e70902c81e2231d4df70c8eb2d12bf76ffceba0964394edec64dccd72c0e06 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ndzylsmrtvnivo\698cb8bc = b4a03ebfe340e021f057a22fb1033a006c4b59d5ddc80f74 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2412 regsvr32.exe 2412 regsvr32.exe 432 regsvr32.exe 432 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2412 regsvr32.exe 432 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1324 wrote to memory of 2412 1324 regsvr32.exe regsvr32.exe PID 1324 wrote to memory of 2412 1324 regsvr32.exe regsvr32.exe PID 1324 wrote to memory of 2412 1324 regsvr32.exe regsvr32.exe PID 2412 wrote to memory of 2784 2412 regsvr32.exe explorer.exe PID 2412 wrote to memory of 2784 2412 regsvr32.exe explorer.exe PID 2412 wrote to memory of 2784 2412 regsvr32.exe explorer.exe PID 2412 wrote to memory of 2784 2412 regsvr32.exe explorer.exe PID 2412 wrote to memory of 2784 2412 regsvr32.exe explorer.exe PID 2784 wrote to memory of 3836 2784 explorer.exe schtasks.exe PID 2784 wrote to memory of 3836 2784 explorer.exe schtasks.exe PID 2784 wrote to memory of 3836 2784 explorer.exe schtasks.exe PID 1032 wrote to memory of 432 1032 regsvr32.exe regsvr32.exe PID 1032 wrote to memory of 432 1032 regsvr32.exe regsvr32.exe PID 1032 wrote to memory of 432 1032 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 604 432 regsvr32.exe explorer.exe PID 432 wrote to memory of 604 432 regsvr32.exe explorer.exe PID 432 wrote to memory of 604 432 regsvr32.exe explorer.exe PID 432 wrote to memory of 604 432 regsvr32.exe explorer.exe PID 432 wrote to memory of 604 432 regsvr32.exe explorer.exe PID 604 wrote to memory of 2460 604 explorer.exe reg.exe PID 604 wrote to memory of 2460 604 explorer.exe reg.exe PID 604 wrote to memory of 1300 604 explorer.exe reg.exe PID 604 wrote to memory of 1300 604 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\450184.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\450184.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ejgdbzkrd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\450184.dll\"" /SC ONCE /Z /ST 00:21 /ET 00:334⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\450184.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\450184.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fuipjbooxh" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Shukmjcpla" /d "0"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\450184.dllMD5
9ce1e32e3d046f8d48fdd17f49d7a3da
SHA1e0cd269248501022f9cf8cd31b678e039cb029d1
SHA25631115320c06d44714df32b4c26f33a8e14396f97ad46433cd30ec3eee01b2750
SHA5126c8d0bce56f282d235df8715d5d46ff1e020f8293ce3e1b0053515a6d6527e97a626d5395273a7d2fb251717cae840dc99878794a42f2964db7cbafd66e29232
-
\Users\Admin\AppData\Local\Temp\450184.dllMD5
9ce1e32e3d046f8d48fdd17f49d7a3da
SHA1e0cd269248501022f9cf8cd31b678e039cb029d1
SHA25631115320c06d44714df32b4c26f33a8e14396f97ad46433cd30ec3eee01b2750
SHA5126c8d0bce56f282d235df8715d5d46ff1e020f8293ce3e1b0053515a6d6527e97a626d5395273a7d2fb251717cae840dc99878794a42f2964db7cbafd66e29232
-
memory/432-122-0x0000000000000000-mapping.dmp
-
memory/604-124-0x0000000000000000-mapping.dmp
-
memory/604-127-0x00000000039A0000-0x00000000039A1000-memory.dmpFilesize
4KB
-
memory/604-128-0x00000000039A0000-0x00000000039A1000-memory.dmpFilesize
4KB
-
memory/604-129-0x0000000003600000-0x0000000003621000-memory.dmpFilesize
132KB
-
memory/1300-126-0x0000000000000000-mapping.dmp
-
memory/2412-115-0x0000000000000000-mapping.dmp
-
memory/2460-125-0x0000000000000000-mapping.dmp
-
memory/2784-119-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2784-120-0x0000000000E80000-0x0000000000EA1000-memory.dmpFilesize
132KB
-
memory/2784-118-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2784-116-0x0000000000000000-mapping.dmp
-
memory/3836-117-0x0000000000000000-mapping.dmp