Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-12-2021 22:51
Static task
static1
Behavioral task
behavioral1
Sample
2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll
Resource
win7-en-20211208
General
-
Target
2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll
-
Size
881KB
-
MD5
f8832c9c2d532586a6a27c18b1618d1c
-
SHA1
ad9ab0a5676f563357329fb97ab8ae037e0690a1
-
SHA256
2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd
-
SHA512
3a6503c6d1b98e9833bd83ef27289211b778cb0cbbe6acf8a59d114b92f6bd2f998f9f5fef5d31fef23cbecd2ed44d480f3c19dbb6036ac670c5cb4abf029750
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1736 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\d80f710b = 490d7a110b5fe6cdbf921153e24884390269607499fb12a86dd88a8b2b862a35f9a712 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\ed90a145 = a926b0a37b3cf401a7b3489caaf542fe119f913c7d92d2aae84cc8ae42b1db30847291c7bed5db244eda36fd9a7657a9d79a15731a885d600c1fc2309e18956e9358d23108c182c39632db64358d76a4c3d4bbe3207c5d0db98f0f1eb7e649b220d445fea10633c3b4151383dd499d4c261ee6936545d7cd2852df4fa3de4668b53d064406304041ee96b64694d52fbc56ff8d563ab26192789a72a49d699de00ffa292f1ee65acc70a736cbd623138c76aa948fc9a460 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\576de65c = 0bb3c811d60af7eb38fd067539b6fb83323c0e2a0293d26043d83b78ba438e0cb73fcedd73e7d9a7c4318e9cd22fb34f0921f81c64ba42f4c6e13aef91da0efcf4da406729a3238b2744411c39a2624b73e20cc9d6 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\92d9ceb3 = 7f1c166de5ae8f2b23a01caa257e4c20e1985f63fc72776b851fa5ffc72190ab56e137b9b5f9d79289a1d913224ff365a1c82a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\552cc620 = 6a6f4ac7da6eff8884c8052a2d8cc22170da13430de6eb2ba50da79e3608b2c165ecd46144a4fdc50e5cc3ef0660539bc3c0ed78ef94b67092fe9fd14ccea23eba3796bb889e477e37ad5ffddcc245add345e4491a69ebbb056e56d8592f4b7ad2c04d6ae04f7d3ca1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\d80f710b = 490d6d110b5fd366d7e146fad963eaa51009e865e40afc2223e6bd52fcacbfd9f0a31b81d6f9e916d60b70ee09874a3213da05952d74af7a explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\2a65a9d6 = ba637baa2cb8a15e19b3f51b17dbcda1ff905e865f238f2c60509d1793736dd63ccbf2e9595e193b3a0b02c2c9bc26c16d9c7497e4bbaea8ea68df1dce61fb2b1c203aa844f4e44ce0f0b0adf6c59d1beded9e97e3227686d6c886d227b3069fbc4adceb7016287183bbe5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\a7461efd = 911db457ebcdb99e39b1863273223ea33f381c0af5b982b7623e77c79c826d407cd5bebef48ed270dca621f7632d9b95d5b17e32d6d62d019ab9f9a4e6ba84279fd906c58202819914d0e2a6d56c4082e8d11b3bc762db4ab904af9001caff0cda9ba95ababebe71ab9e36628cf309 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Caqbkxwrv\efd18139 = fd0cb3d093a1dd9ad349f7e2f0c6e66d7506870187f0311e41862fcde2529183881d08c31350d566dbe5ed60ce7d7c4f8f4116969c36fd89 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1616 regsvr32.exe 1736 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1616 regsvr32.exe 1736 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 956 wrote to memory of 1616 956 regsvr32.exe regsvr32.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1616 wrote to memory of 1872 1616 regsvr32.exe explorer.exe PID 1872 wrote to memory of 788 1872 explorer.exe schtasks.exe PID 1872 wrote to memory of 788 1872 explorer.exe schtasks.exe PID 1872 wrote to memory of 788 1872 explorer.exe schtasks.exe PID 1872 wrote to memory of 788 1872 explorer.exe schtasks.exe PID 1224 wrote to memory of 1816 1224 taskeng.exe regsvr32.exe PID 1224 wrote to memory of 1816 1224 taskeng.exe regsvr32.exe PID 1224 wrote to memory of 1816 1224 taskeng.exe regsvr32.exe PID 1224 wrote to memory of 1816 1224 taskeng.exe regsvr32.exe PID 1224 wrote to memory of 1816 1224 taskeng.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1816 wrote to memory of 1736 1816 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1736 wrote to memory of 1200 1736 regsvr32.exe explorer.exe PID 1200 wrote to memory of 1724 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1724 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1724 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1724 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1076 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1076 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1076 1200 explorer.exe reg.exe PID 1200 wrote to memory of 1076 1200 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cupsqkz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll\"" /SC ONCE /Z /ST 22:53 /ET 23:054⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {F0764F46-7882-4AC4-917A-7D3C3655094B} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Akaikpid" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Hdtaqvuta" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dllMD5
f8832c9c2d532586a6a27c18b1618d1c
SHA1ad9ab0a5676f563357329fb97ab8ae037e0690a1
SHA2562c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd
SHA5123a6503c6d1b98e9833bd83ef27289211b778cb0cbbe6acf8a59d114b92f6bd2f998f9f5fef5d31fef23cbecd2ed44d480f3c19dbb6036ac670c5cb4abf029750
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\2c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd.dllMD5
f8832c9c2d532586a6a27c18b1618d1c
SHA1ad9ab0a5676f563357329fb97ab8ae037e0690a1
SHA2562c10df26a553b09ad12d5452bc50e527136bf6613b35d01f4feba4e1060353bd
SHA5123a6503c6d1b98e9833bd83ef27289211b778cb0cbbe6acf8a59d114b92f6bd2f998f9f5fef5d31fef23cbecd2ed44d480f3c19dbb6036ac670c5cb4abf029750
-
memory/788-61-0x0000000000000000-mapping.dmp
-
memory/956-53-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmpFilesize
8KB
-
memory/1076-76-0x0000000000000000-mapping.dmp
-
memory/1200-71-0x0000000000000000-mapping.dmp
-
memory/1200-77-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1616-56-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1616-62-0x0000000010000000-0x00000000100FA000-memory.dmpFilesize
1000KB
-
memory/1616-55-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/1616-54-0x0000000000000000-mapping.dmp
-
memory/1724-75-0x0000000000000000-mapping.dmp
-
memory/1736-67-0x0000000000000000-mapping.dmp
-
memory/1816-64-0x0000000000000000-mapping.dmp
-
memory/1872-57-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1872-63-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1872-60-0x0000000074E51000-0x0000000074E53000-memory.dmpFilesize
8KB
-
memory/1872-58-0x0000000000000000-mapping.dmp