Analysis
-
max time kernel
133s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-12-2021 14:44
Static task
static1
Behavioral task
behavioral1
Sample
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll
Resource
win7-en-20211208
General
-
Target
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll
-
Size
825KB
-
MD5
3142cbf3b97b301f787b5dfdde5e4b62
-
SHA1
d5c85a79f8afbaf828538e1544abcdf254cb2c6a
-
SHA256
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
-
SHA512
1b0c8ec21f42b5ca2cb7ab3a3b66c139c0a807c4cf399f4649f21f27913f351c04cb4676b37d7de5fe93bbca02119103d4b510ef6cfd819492292af4db5da0d7
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3604 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\87676601 = 3650f5332449d08120a7fc722d755b69760caea4908ebf9196986344766fa159e7e74cedf05341b217 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\a44d12a = c30cbf5c869a4a875ed9fbfdcb3c1b679819bfa2306b103386ee1034eca8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\87676601 = 3650e2332449e5d09f19de88c6a4ec374bca2f41cd112ac65c301bd3f12604a5948b2865bc8f6886bb0259b9b9682ec996ffeed8d7e1d15949f83d8667cb explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\cdb1d9b9 = 65459f6afac4bc1368959592e0b654f177c787bf08e6c585effa084962eccb36b7b90d62c326c1e913a3449915f9f1563609b3670a6b99b1ae3433a1cb685c482fc4db4a83226097e155bd40a40832136e5e7f69d04e8e9a0fc6740e6a5d6d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\f82e09f7 = a4385829db16f1ed4c89f640f666c19096b3b855e17b2a2f1a2b9993accd8172a29a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\b2f8b64f = 31c06c2d3d6151c51f47660aa54e12ed7919159255c510c6a359d03ddff724901d511ac94033263e729eb1049fe9179a18d0cb8ff03c71d19646b835c013087a2868788400d5ce1b48e6ac60125cc8338c793d087c66aa4c4186f75a6e9e5dd27819c174573a0c3efc93c597b12f4c59f83186031dd08425c88490b9f4194706cfca226983ca34b2ce52ef44e84265ce05459f59a0813d874d353d4eaea3031b4684fa5842b694471df00fa113a657 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\b0b99633 = 2f5d6d0d6f94056ec5df18da76addc376c79a2605a00b85385e34300a436e195f334060516c694638af3522e2973822e0536f9c72d56a1c7071b9d47b19427f7486e21cbd0f2498eeacd25499b01d8b8327c2c553cdf7572f018aab05d71118fc9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\805f156 = e4791032548bf8ad5f84262e6bf048f30f49295936 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ucevnuam\750dbedc = f05869e78d73d661dc26e453e19a8c3c6b544bd3a5cc2333bb8eddf77ea4f614760d01bd7c2e46b6df71dd93b36997f2658ddd01492455ebd0af3e1b695a8ada65ddc13fd78b4b3426d0afd37f7a21245e59e58702f9259a40a695f946accd20baacb844520934 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2760 regsvr32.exe 2760 regsvr32.exe 3604 regsvr32.exe 3604 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2760 regsvr32.exe 3604 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3672 wrote to memory of 2760 3672 regsvr32.exe regsvr32.exe PID 3672 wrote to memory of 2760 3672 regsvr32.exe regsvr32.exe PID 3672 wrote to memory of 2760 3672 regsvr32.exe regsvr32.exe PID 2760 wrote to memory of 1384 2760 regsvr32.exe explorer.exe PID 2760 wrote to memory of 1384 2760 regsvr32.exe explorer.exe PID 2760 wrote to memory of 1384 2760 regsvr32.exe explorer.exe PID 2760 wrote to memory of 1384 2760 regsvr32.exe explorer.exe PID 2760 wrote to memory of 1384 2760 regsvr32.exe explorer.exe PID 1384 wrote to memory of 2924 1384 explorer.exe schtasks.exe PID 1384 wrote to memory of 2924 1384 explorer.exe schtasks.exe PID 1384 wrote to memory of 2924 1384 explorer.exe schtasks.exe PID 2392 wrote to memory of 3604 2392 regsvr32.exe regsvr32.exe PID 2392 wrote to memory of 3604 2392 regsvr32.exe regsvr32.exe PID 2392 wrote to memory of 3604 2392 regsvr32.exe regsvr32.exe PID 3604 wrote to memory of 3228 3604 regsvr32.exe explorer.exe PID 3604 wrote to memory of 3228 3604 regsvr32.exe explorer.exe PID 3604 wrote to memory of 3228 3604 regsvr32.exe explorer.exe PID 3604 wrote to memory of 3228 3604 regsvr32.exe explorer.exe PID 3604 wrote to memory of 3228 3604 regsvr32.exe explorer.exe PID 3228 wrote to memory of 372 3228 explorer.exe reg.exe PID 3228 wrote to memory of 372 3228 explorer.exe reg.exe PID 3228 wrote to memory of 2800 3228 explorer.exe reg.exe PID 3228 wrote to memory of 2800 3228 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lkoedgsclz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll\"" /SC ONCE /Z /ST 12:04 /ET 12:164⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Deonnzcepjee" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zuyevwyb" /d "0"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dllMD5
3142cbf3b97b301f787b5dfdde5e4b62
SHA1d5c85a79f8afbaf828538e1544abcdf254cb2c6a
SHA256186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
SHA5121b0c8ec21f42b5ca2cb7ab3a3b66c139c0a807c4cf399f4649f21f27913f351c04cb4676b37d7de5fe93bbca02119103d4b510ef6cfd819492292af4db5da0d7
-
\Users\Admin\AppData\Local\Temp\186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc.dllMD5
3142cbf3b97b301f787b5dfdde5e4b62
SHA1d5c85a79f8afbaf828538e1544abcdf254cb2c6a
SHA256186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
SHA5121b0c8ec21f42b5ca2cb7ab3a3b66c139c0a807c4cf399f4649f21f27913f351c04cb4676b37d7de5fe93bbca02119103d4b510ef6cfd819492292af4db5da0d7
-
memory/372-128-0x0000000000000000-mapping.dmp
-
memory/1384-118-0x0000000000000000-mapping.dmp
-
memory/1384-120-0x0000000003380000-0x0000000003381000-memory.dmpFilesize
4KB
-
memory/1384-121-0x0000000003380000-0x0000000003381000-memory.dmpFilesize
4KB
-
memory/1384-122-0x0000000000C40000-0x0000000000C61000-memory.dmpFilesize
132KB
-
memory/2760-117-0x0000000010000000-0x00000000100FA000-memory.dmpFilesize
1000KB
-
memory/2760-116-0x0000000000AD0000-0x0000000000B7E000-memory.dmpFilesize
696KB
-
memory/2760-115-0x0000000000000000-mapping.dmp
-
memory/2800-129-0x0000000000000000-mapping.dmp
-
memory/2924-119-0x0000000000000000-mapping.dmp
-
memory/3228-127-0x0000000000000000-mapping.dmp
-
memory/3228-130-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/3228-131-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/3228-132-0x0000000000450000-0x0000000000471000-memory.dmpFilesize
132KB
-
memory/3604-126-0x0000000000420000-0x00000000004CE000-memory.dmpFilesize
696KB
-
memory/3604-124-0x0000000000000000-mapping.dmp