Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-12-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll
Resource
win7-en-20211208
General
-
Target
2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll
-
Size
958KB
-
MD5
8fc78bdb91458a75ee1c6228337190b1
-
SHA1
879f1f5fe678deb5ec4743eb60a364577d17d7bf
-
SHA256
2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3
-
SHA512
362991facd6668e42a2ec59bff17bbedabcad94212f9cedadcb92b4dbc28e32bb209c12cb4d0ef40029be8818de9e204cb11d03dd7d9e3fc380a927d5590f0de
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 704 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1356 regsvr32.exe 1356 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1356 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 596 wrote to memory of 1356 596 regsvr32.exe regsvr32.exe PID 596 wrote to memory of 1356 596 regsvr32.exe regsvr32.exe PID 596 wrote to memory of 1356 596 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2008 1356 regsvr32.exe explorer.exe PID 1356 wrote to memory of 2008 1356 regsvr32.exe explorer.exe PID 1356 wrote to memory of 2008 1356 regsvr32.exe explorer.exe PID 1356 wrote to memory of 2008 1356 regsvr32.exe explorer.exe PID 1356 wrote to memory of 2008 1356 regsvr32.exe explorer.exe PID 2008 wrote to memory of 2964 2008 explorer.exe schtasks.exe PID 2008 wrote to memory of 2964 2008 explorer.exe schtasks.exe PID 2008 wrote to memory of 2964 2008 explorer.exe schtasks.exe PID 1172 wrote to memory of 704 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 704 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 704 1172 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lfnvacqka /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll\"" /SC ONCE /Z /ST 06:19 /ET 06:314⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dll"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dllMD5
8fc78bdb91458a75ee1c6228337190b1
SHA1879f1f5fe678deb5ec4743eb60a364577d17d7bf
SHA2562abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3
SHA512362991facd6668e42a2ec59bff17bbedabcad94212f9cedadcb92b4dbc28e32bb209c12cb4d0ef40029be8818de9e204cb11d03dd7d9e3fc380a927d5590f0de
-
\Users\Admin\AppData\Local\Temp\2abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3.dllMD5
8fc78bdb91458a75ee1c6228337190b1
SHA1879f1f5fe678deb5ec4743eb60a364577d17d7bf
SHA2562abda935db7d445ca540f92c60d03172b54d2b7a9da159b1a24a658034a3d7a3
SHA512362991facd6668e42a2ec59bff17bbedabcad94212f9cedadcb92b4dbc28e32bb209c12cb4d0ef40029be8818de9e204cb11d03dd7d9e3fc380a927d5590f0de
-
memory/704-127-0x0000000000000000-mapping.dmp
-
memory/1356-118-0x0000000000000000-mapping.dmp
-
memory/1356-120-0x0000000010000000-0x00000000100F5000-memory.dmpFilesize
980KB
-
memory/1356-119-0x0000000002BD0000-0x0000000002BF3000-memory.dmpFilesize
140KB
-
memory/2008-121-0x0000000000000000-mapping.dmp
-
memory/2008-122-0x00000000030A0000-0x00000000030C1000-memory.dmpFilesize
132KB
-
memory/2008-124-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/2008-125-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/2964-123-0x0000000000000000-mapping.dmp