Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 18:12
Static task
static1
Behavioral task
behavioral1
Sample
b22026d045873d54eeffc181b0bd282e.dll
Resource
win7-en-20210920
General
-
Target
b22026d045873d54eeffc181b0bd282e.dll
-
Size
1.2MB
-
MD5
6dd575fb4081e2946812ffa942557edc
-
SHA1
a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729
-
SHA256
9b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe
-
SHA512
f9bae851d5c39123a9c351537b384084c7051409374b90fb57e5edd1d0ee4e60e17d2e0ffb4606304f323869d3eacfdee7b0a389bc25d69c29c8ba150e400d33
Malware Config
Extracted
qakbot
402.363
tr
1634905513
27.5.5.31:2222
136.143.11.232:443
68.186.192.69:443
117.198.157.160:443
108.4.67.252:443
207.246.112.221:995
105.198.236.99:995
37.208.181.198:61200
115.99.227.13:995
140.82.49.12:443
188.50.34.167:995
216.201.162.158:443
103.142.10.177:443
197.89.21.241:443
73.25.109.183:2222
81.250.153.227:2222
2.222.167.138:443
78.191.24.189:995
87.242.20.233:2222
89.101.97.139:443
37.208.181.198:443
96.246.158.154:995
45.9.20.200:443
102.65.38.131:443
2.50.74.220:443
207.246.112.221:443
117.215.92.114:443
41.228.22.180:443
120.150.218.241:995
123.252.190.14:443
146.212.30.77:443
86.120.85.209:443
188.157.140.3:995
136.232.34.70:443
88.226.225.168:443
196.219.95.181:995
39.49.78.75:995
109.12.111.14:443
41.235.69.115:443
196.207.140.40:995
76.25.142.196:443
89.137.52.44:443
27.223.92.142:995
63.143.92.99:995
24.119.214.7:443
75.188.35.168:443
67.165.206.193:993
71.74.12.34:443
173.21.10.71:2222
73.151.236.31:443
209.210.95.228:995
189.135.16.92:443
75.66.88.33:443
187.250.109.250:443
189.146.41.71:443
45.46.53.140:2222
72.252.201.69:995
187.156.134.254:443
100.1.119.41:443
201.137.10.225:443
50.194.160.233:32100
181.4.53.6:465
24.139.72.117:443
24.229.150.54:995
24.55.112.61:443
103.150.40.76:995
77.57.204.78:443
189.152.10.47:80
85.85.46.177:443
182.176.180.73:443
24.231.209.2:6881
24.231.209.2:2222
220.255.25.187:2222
209.210.95.228:993
162.210.220.137:443
93.48.58.123:2222
65.100.174.110:443
146.66.238.74:443
68.204.7.158:443
41.86.42.158:995
187.75.66.160:995
72.173.78.211:443
37.117.191.19:2222
94.200.181.154:443
96.37.113.36:993
24.231.209.2:2083
86.220.112.26:2222
24.152.219.253:995
181.118.183.94:443
37.210.155.239:995
50.194.160.233:465
38.70.253.226:2222
188.221.250.72:995
103.143.8.71:443
187.149.227.40:443
91.178.126.51:995
81.241.252.59:2078
65.100.174.110:995
86.8.177.143:443
209.210.95.228:443
78.71.154.58:2222
47.151.181.188:443
78.71.167.243:2222
117.215.230.90:443
174.54.193.186:443
72.27.84.16:995
39.52.224.154:995
188.54.167.41:443
49.206.29.127:443
103.133.200.139:443
98.203.26.168:443
199.27.127.129:443
208.78.220.143:443
47.40.196.233:2222
86.152.43.219:443
201.111.144.72:443
2.237.74.121:2222
115.96.64.9:995
73.52.50.32:443
103.170.110.153:995
103.170.110.153:465
103.170.110.153:990
31.166.234.68:443
111.91.87.187:995
174.76.17.43:443
213.60.210.85:443
203.175.72.19:995
167.248.117.81:443
116.193.136.10:443
122.179.158.212:443
103.148.120.144:443
103.82.211.39:993
117.202.161.73:2222
65.100.174.110:8443
65.100.174.110:6881
69.30.186.190:443
190.117.91.214:443
39.40.37.70:32100
187.172.17.193:443
80.6.192.58:443
122.60.71.201:995
173.22.178.66:443
2.221.12.60:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1516 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 820 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 820 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 1704 wrote to memory of 820 1704 rundll32.exe rundll32.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 820 wrote to memory of 1120 820 rundll32.exe explorer.exe PID 1120 wrote to memory of 808 1120 explorer.exe schtasks.exe PID 1120 wrote to memory of 808 1120 explorer.exe schtasks.exe PID 1120 wrote to memory of 808 1120 explorer.exe schtasks.exe PID 1120 wrote to memory of 808 1120 explorer.exe schtasks.exe PID 752 wrote to memory of 1428 752 taskeng.exe regsvr32.exe PID 752 wrote to memory of 1428 752 taskeng.exe regsvr32.exe PID 752 wrote to memory of 1428 752 taskeng.exe regsvr32.exe PID 752 wrote to memory of 1428 752 taskeng.exe regsvr32.exe PID 752 wrote to memory of 1428 752 taskeng.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1516 1428 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dygxrigbdv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dll\"" /SC ONCE /Z /ST 18:18 /ET 18:304⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {9C57A75F-F13D-4061-AC14-35D6CA7FF94D} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dllMD5
6dd575fb4081e2946812ffa942557edc
SHA1a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729
SHA2569b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe
SHA512f9bae851d5c39123a9c351537b384084c7051409374b90fb57e5edd1d0ee4e60e17d2e0ffb4606304f323869d3eacfdee7b0a389bc25d69c29c8ba150e400d33
-
\Users\Admin\AppData\Local\Temp\b22026d045873d54eeffc181b0bd282e.dllMD5
6dd575fb4081e2946812ffa942557edc
SHA1a93c65cdfe016795dd72a2d8bd8a2a3fb53a7729
SHA2569b30eafba4d4e1c9491ed31dbe7f9de2acf4e217d8fa162d471993bb05ec14fe
SHA512f9bae851d5c39123a9c351537b384084c7051409374b90fb57e5edd1d0ee4e60e17d2e0ffb4606304f323869d3eacfdee7b0a389bc25d69c29c8ba150e400d33
-
memory/808-64-0x0000000000000000-mapping.dmp
-
memory/820-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/820-56-0x0000000074C10000-0x0000000074D46000-memory.dmpFilesize
1.2MB
-
memory/820-57-0x0000000074C10000-0x0000000074C31000-memory.dmpFilesize
132KB
-
memory/820-59-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/820-58-0x0000000074C10000-0x0000000074D46000-memory.dmpFilesize
1.2MB
-
memory/820-54-0x0000000000000000-mapping.dmp
-
memory/1120-63-0x0000000074A01000-0x0000000074A03000-memory.dmpFilesize
8KB
-
memory/1120-65-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/1120-61-0x0000000000000000-mapping.dmp
-
memory/1120-60-0x00000000000F0000-0x00000000000F2000-memory.dmpFilesize
8KB
-
memory/1428-66-0x0000000000000000-mapping.dmp
-
memory/1428-67-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmpFilesize
8KB
-
memory/1516-69-0x0000000000000000-mapping.dmp