Analysis
-
max time kernel
133s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-12-2021 08:00
Static task
static1
Behavioral task
behavioral1
Sample
2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll
Resource
win7-en-20211208
General
-
Target
2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll
-
Size
858KB
-
MD5
4f2bfea5068bf0f963e778f4f61cd99c
-
SHA1
797d596d9ef376747671cb373207043a5dbaccec
-
SHA256
2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8
-
SHA512
654adb2549cefb51bff892dd0c9964804ff3616496187b855995aab8596e03500d3d0170f90e2ee575fd383e80b341d97d2bb1191febcc4d36630b08d96f15ce
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1512 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\2b82d38c = 915093cc304cf43ed3386a311e8b8a23d018 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\933eb4e9 = 81361e5f4f29903625b0ec475ed8aab872631cd37a25f5b4fc88fe66 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\54cbbc7a = b61ee4e7ec2de1e0d9d037c71d15 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\ee36fb63 = 2f2dd8bea3af8b4910f9140f910eb8aa239cfb6186caad8806af312254ee2927bd6ed0ba42cd24e0915c29ececd3619c530ca4b5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\568a9c06 = cac7d4bfab4723bade63b8f5f1793fbdbdd3c7079c38e6c0bb91dc9cc46ce6f5c7a6d5d266632e197778601d0e470877f274f28c964dc2aec2336908484b4dadf6751e1d59e47eb48814df42da00d9508598f05cabda6a70081258d3b6b3fbe027320ad7a427af5a2143 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\a6a164a7 = b43043ea403ee3f6ad0d439647778c342094d8e75f82bc7812102d4a3a1a307921338c4c56129464d70816aa552cdada453833b146c1d407a98f95d1be00fbc3 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\d9e80b51 = 1029c93f41104044fa520bb6c211d355ac22e7edc74332ed807c8afa37b270e9283f1e88562495ee1e6ca7e9c73e5756a1e9fe076379a50d8d6e87894bae86717788ece396d431f805f1b2f6944a83047f898c09687be0e6b569d919ecd294f73e093c95dc253b explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\d9e80b51 = 1029de3f411075aa26f33638aaf0e3d1164502e6c8f98ba9b4fd51e2a6d1f9aaec28dc6758a66bbaf34672c7f8cde8c3538e3a0993029e9e75bd665564894327d7ece7f67ba60beb7fe585f86023b4bce649 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Psuyiujeylpjs\ec77db1f = cddbeafa755588f96cbc64e5ad5f4aeebd90e872264c9840c4ac8fa4137b73174778204ce2a1a60501247f91455c9b3b11a3ebb1008ee2ca935f97f4eab8a92b878347d255b47d0c909b25137732357cb7029e660935bddfd23074270129e41d855d0dbc0bb3de0cf0c3af9abc4894ee5410c1aafff374181208e98a60507e0c9f7ccdc5e411332f231aedce2d17fc6fd866f06de40ac85cb59ea74e4de6e22bc2b53ac4b0c4f45f7fce29bb940b69f718ebeae5f58a2b790ba207f37580a76af5bffff259eaf013487d explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1672 regsvr32.exe 1512 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1672 regsvr32.exe 1512 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 948 wrote to memory of 1672 948 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1672 wrote to memory of 1288 1672 regsvr32.exe explorer.exe PID 1288 wrote to memory of 1496 1288 explorer.exe schtasks.exe PID 1288 wrote to memory of 1496 1288 explorer.exe schtasks.exe PID 1288 wrote to memory of 1496 1288 explorer.exe schtasks.exe PID 1288 wrote to memory of 1496 1288 explorer.exe schtasks.exe PID 1212 wrote to memory of 1820 1212 taskeng.exe regsvr32.exe PID 1212 wrote to memory of 1820 1212 taskeng.exe regsvr32.exe PID 1212 wrote to memory of 1820 1212 taskeng.exe regsvr32.exe PID 1212 wrote to memory of 1820 1212 taskeng.exe regsvr32.exe PID 1212 wrote to memory of 1820 1212 taskeng.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1820 wrote to memory of 1512 1820 regsvr32.exe regsvr32.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1512 wrote to memory of 1336 1512 regsvr32.exe explorer.exe PID 1336 wrote to memory of 1940 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1940 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1940 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1940 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1948 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1948 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1948 1336 explorer.exe reg.exe PID 1336 wrote to memory of 1948 1336 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dtufjqu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll\"" /SC ONCE /Z /ST 09:02 /ET 09:144⤵
- Creates scheduled task(s)
PID:1496
-
C:\Windows\system32\taskeng.exetaskeng.exe {CE9EFE65-9B68-42A5-BC2F-DC251FA0DB32} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ldcyxooorh" /d "0"5⤵PID:1940
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xoyjioxejf" /d "0"5⤵PID:1948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dllMD5
4f2bfea5068bf0f963e778f4f61cd99c
SHA1797d596d9ef376747671cb373207043a5dbaccec
SHA2562599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8
SHA512654adb2549cefb51bff892dd0c9964804ff3616496187b855995aab8596e03500d3d0170f90e2ee575fd383e80b341d97d2bb1191febcc4d36630b08d96f15ce
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\2599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8.dllMD5
4f2bfea5068bf0f963e778f4f61cd99c
SHA1797d596d9ef376747671cb373207043a5dbaccec
SHA2562599965afc0a2ae60c8b61f82ecaf6a92918dd795d95121f951658a32ac737f8
SHA512654adb2549cefb51bff892dd0c9964804ff3616496187b855995aab8596e03500d3d0170f90e2ee575fd383e80b341d97d2bb1191febcc4d36630b08d96f15ce
-
memory/948-55-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmpFilesize
8KB
-
memory/1288-60-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1288-61-0x0000000000000000-mapping.dmp
-
memory/1288-63-0x0000000074861000-0x0000000074863000-memory.dmpFilesize
8KB
-
memory/1288-64-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/1336-79-0x00000000000C0000-0x00000000000E1000-memory.dmpFilesize
132KB
-
memory/1336-73-0x0000000000000000-mapping.dmp
-
memory/1496-65-0x0000000000000000-mapping.dmp
-
memory/1512-69-0x0000000000000000-mapping.dmp
-
memory/1672-59-0x0000000010000000-0x00000000100FA000-memory.dmpFilesize
1000KB
-
memory/1672-58-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1672-57-0x0000000075321000-0x0000000075323000-memory.dmpFilesize
8KB
-
memory/1672-56-0x0000000000000000-mapping.dmp
-
memory/1820-66-0x0000000000000000-mapping.dmp
-
memory/1940-77-0x0000000000000000-mapping.dmp
-
memory/1948-78-0x0000000000000000-mapping.dmp