Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
23-10-2021 23:07
Static task
static1
Behavioral task
behavioral1
Sample
e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5.dll
Resource
win7-en-20211014
General
-
Target
e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5.dll
-
Size
512KB
-
MD5
c12d474142ae599f4b7d3c3decca27c0
-
SHA1
86326c7cae713774ddf65a90be20a49a86c0a11d
-
SHA256
e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5
-
SHA512
0b4cdf6986fe985d5a9260760e398694315d45b86a33693c851f357a59083c100cc5b88c62e05cf29159b467bef3dc47aa39230cadf79cf62aa7b515b2ec58e3
Malware Config
Extracted
qakbot
402.363
star01
1634935795
45.9.20.200:443
96.246.158.154:995
67.165.206.193:993
207.246.112.221:443
37.208.181.198:61202
77.255.12.88:443
79.160.207.214:443
216.201.162.158:443
185.53.147.51:443
187.250.109.250:443
173.21.10.71:2222
108.4.67.252:443
93.175.84.127:443
84.117.135.69:443
87.64.241.207:995
207.246.112.221:995
188.50.34.167:995
73.25.109.183:2222
213.177.130.71:443
176.63.117.1:443
89.101.97.139:443
76.25.142.196:443
5.224.28.151:995
41.228.22.180:443
189.135.16.92:443
201.137.10.225:443
100.1.119.41:443
189.146.41.71:443
73.151.236.31:443
120.150.218.241:995
196.219.95.181:995
189.218.23.60:443
77.57.204.78:443
151.76.194.13:995
24.229.150.54:995
85.226.176.123:2222
181.4.53.6:465
24.139.72.117:443
103.150.40.76:995
71.74.12.34:443
109.12.111.14:443
136.143.11.232:443
68.186.192.69:443
93.102.128.205:3389
2.222.167.138:443
75.188.35.168:443
37.208.181.198:443
72.252.201.69:995
102.65.38.131:443
189.152.10.47:80
45.46.53.140:2222
88.226.225.168:443
83.243.251.46:443
136.232.34.70:443
39.49.78.75:995
196.207.140.40:995
86.220.112.26:2222
27.5.5.31:2222
117.198.157.160:443
105.198.236.99:995
115.99.227.13:995
103.142.10.177:443
197.89.21.241:443
81.250.153.227:2222
78.191.24.189:995
87.242.20.233:2222
2.50.74.220:443
117.215.92.114:443
123.252.190.14:443
146.212.30.77:443
86.120.85.209:443
188.157.140.3:995
41.235.69.115:443
89.137.52.44:443
27.223.92.142:995
63.143.92.99:995
24.119.214.7:443
209.210.95.228:995
75.66.88.33:443
50.194.160.233:32100
24.55.112.61:443
85.85.46.177:443
182.176.180.73:443
24.231.209.2:6881
24.231.209.2:2222
220.255.25.187:2222
209.210.95.228:993
162.210.220.137:443
93.48.58.123:2222
65.100.174.110:443
146.66.238.74:443
68.204.7.158:443
41.86.42.158:995
187.75.66.160:995
72.173.78.211:443
37.117.191.19:2222
94.200.181.154:443
96.37.113.36:993
24.231.209.2:2083
24.152.219.253:995
181.118.183.94:443
37.210.155.239:995
50.194.160.233:465
38.70.253.226:2222
188.221.250.72:995
103.143.8.71:443
187.149.227.40:443
91.178.126.51:995
81.241.252.59:2078
65.100.174.110:995
86.8.177.143:443
209.210.95.228:443
78.71.154.58:2222
47.151.181.188:443
78.71.167.243:2222
117.215.230.90:443
174.54.193.186:443
72.27.84.16:995
39.52.224.154:995
188.54.167.41:443
49.206.29.127:443
103.133.200.139:443
98.203.26.168:443
199.27.127.129:443
208.78.220.143:443
47.40.196.233:2222
86.152.43.219:443
201.111.144.72:443
2.237.74.121:2222
115.96.64.9:995
73.52.50.32:443
103.170.110.153:995
103.170.110.153:465
103.170.110.153:990
31.166.234.68:443
111.91.87.187:995
174.76.17.43:443
213.60.210.85:443
203.175.72.19:995
167.248.117.81:443
116.193.136.10:443
122.179.158.212:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2784 rundll32.exe 2784 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 2784 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exedescription pid process target process PID 3716 wrote to memory of 2784 3716 rundll32.exe rundll32.exe PID 3716 wrote to memory of 2784 3716 rundll32.exe rundll32.exe PID 3716 wrote to memory of 2784 3716 rundll32.exe rundll32.exe PID 2784 wrote to memory of 2232 2784 rundll32.exe explorer.exe PID 2784 wrote to memory of 2232 2784 rundll32.exe explorer.exe PID 2784 wrote to memory of 2232 2784 rundll32.exe explorer.exe PID 2784 wrote to memory of 2232 2784 rundll32.exe explorer.exe PID 2784 wrote to memory of 2232 2784 rundll32.exe explorer.exe PID 2232 wrote to memory of 1340 2232 explorer.exe schtasks.exe PID 2232 wrote to memory of 1340 2232 explorer.exe schtasks.exe PID 2232 wrote to memory of 1340 2232 explorer.exe schtasks.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yuamlzyzp /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e709bd31b9d0f340605499771a33521a09ba3f9b17d19706ecb7748fea93dae5.dll\"" /SC ONCE /Z /ST 23:09 /ET 23:214⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-119-0x0000000000000000-mapping.dmp
-
memory/2232-118-0x0000000000000000-mapping.dmp
-
memory/2232-120-0x0000000003360000-0x0000000003361000-memory.dmpFilesize
4KB
-
memory/2232-121-0x0000000003360000-0x0000000003361000-memory.dmpFilesize
4KB
-
memory/2232-122-0x00000000007A0000-0x00000000007C1000-memory.dmpFilesize
132KB
-
memory/2784-115-0x0000000000000000-mapping.dmp
-
memory/2784-117-0x0000000010000000-0x0000000010084000-memory.dmpFilesize
528KB
-
memory/2784-116-0x00000000030E0000-0x0000000003113000-memory.dmpFilesize
204KB