Analysis
-
max time kernel
135s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-12-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll
Resource
win7-en-20211208
General
-
Target
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll
-
Size
959KB
-
MD5
e5ef2b91bcdb8037bb2465c84c28248b
-
SHA1
adaad69a8641a607d7fc77c7cd11d6981c8afde0
-
SHA256
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
-
SHA512
66c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1064 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\a5bd5d5b = cae169b9db5a0579560229325e64b38549d48f1df384dde917814e131ac94fb34bb25973eeb2d561b71c141a328ab9ad800e5ba6dc explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\1d013a3e = 67fe5a1dfdad04ccaed33fa0a0afc5e17cfcbe24 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\57d78586 = 7466cf7b17433a0bb9c842c0f2761751ee9721f22ac503ef6d93b540940ec1b124c721577ec02ff3b22c4356588816653eed explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\57d78586 = 7466d87b17430fd7759657c5156e414d727aa15493546a4375400a5cbd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\624855c8 = 176a71d30e3c1b445f21f5b7192140212097205ac23976e67664ace94f42daabc1095c12c5c796769e974af233d2256564e3aead4ddcf5737e95e83f00ea032a404749871d57e50496de80f7672f399c140e4e86166f0ad417ceb11bb97967dbe45036270d48f5621d7e18d64bca83a4abe046714c38467c17f2e7a0cee5c9b96e34d76256f39dccaadb427c9e9398ae1352820c07db87b6546a46fdaba5be6a1056b1fb251384b511a299311e97ffc2f83ee5305cf086d7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\600975b4 = 89698b9afb4a512697c4c8e3602fb3d20266b98a2813bc2a9e7f9454d463455ef3129d1f05e74a05815ec28bced30b41810d59a33f532d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\d8b512d1 = 9fee90c973101e0cddf90a99b4ecba79e58e6dc7da48d16e018d5009142bf0f9aad23f695b1d9b87aa333bd982d89d186aca1e53e6507f7bf7e0bc014e311e4ddcb3 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\daf432ad = 6c9d69c6292318f6a3d15fa51d32948c65853299013687cd6aa033a6d085434175894f98a8adecb8c0b67edd35de883454ac3951120bcca59926e644d88d12e218e132f3a24fffcd63ad603274 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Wiboeqtfii\289eea70 = 87270b9e6376c4cce14122758490039bf86f636c39d54a75b46d595db8ff0fe0c0ea558ddf244ac11c26182318582691ce4cbf1fcfedb96e6699ab3dcac8 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Wiboeqtfii explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 836 regsvr32.exe 1064 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 836 regsvr32.exe 1064 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 1624 wrote to memory of 836 1624 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 836 wrote to memory of 660 836 regsvr32.exe explorer.exe PID 660 wrote to memory of 1396 660 explorer.exe schtasks.exe PID 660 wrote to memory of 1396 660 explorer.exe schtasks.exe PID 660 wrote to memory of 1396 660 explorer.exe schtasks.exe PID 660 wrote to memory of 1396 660 explorer.exe schtasks.exe PID 1500 wrote to memory of 1080 1500 taskeng.exe regsvr32.exe PID 1500 wrote to memory of 1080 1500 taskeng.exe regsvr32.exe PID 1500 wrote to memory of 1080 1500 taskeng.exe regsvr32.exe PID 1500 wrote to memory of 1080 1500 taskeng.exe regsvr32.exe PID 1500 wrote to memory of 1080 1500 taskeng.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1080 wrote to memory of 1064 1080 regsvr32.exe regsvr32.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 1064 wrote to memory of 984 1064 regsvr32.exe explorer.exe PID 984 wrote to memory of 1716 984 explorer.exe reg.exe PID 984 wrote to memory of 1716 984 explorer.exe reg.exe PID 984 wrote to memory of 1716 984 explorer.exe reg.exe PID 984 wrote to memory of 1716 984 explorer.exe reg.exe PID 984 wrote to memory of 1748 984 explorer.exe reg.exe PID 984 wrote to memory of 1748 984 explorer.exe reg.exe PID 984 wrote to memory of 1748 984 explorer.exe reg.exe PID 984 wrote to memory of 1748 984 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ofusieeg /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll\"" /SC ONCE /Z /ST 17:13 /ET 17:254⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {9DA8AF4C-81D2-4B7A-848E-A10BBBD0425F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ixmhefye" /d "0"5⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jfgeiouudg" /d "0"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dllMD5
e5ef2b91bcdb8037bb2465c84c28248b
SHA1adaad69a8641a607d7fc77c7cd11d6981c8afde0
SHA256bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
SHA51266c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
-
\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dllMD5
e5ef2b91bcdb8037bb2465c84c28248b
SHA1adaad69a8641a607d7fc77c7cd11d6981c8afde0
SHA256bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
SHA51266c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
-
memory/660-59-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/660-60-0x0000000000000000-mapping.dmp
-
memory/660-62-0x0000000074AA1000-0x0000000074AA3000-memory.dmpFilesize
8KB
-
memory/660-64-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/836-55-0x0000000000000000-mapping.dmp
-
memory/836-56-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/836-57-0x0000000000170000-0x00000000001F0000-memory.dmpFilesize
512KB
-
memory/836-58-0x0000000010000000-0x00000000100F5000-memory.dmpFilesize
980KB
-
memory/984-78-0x0000000000080000-0x00000000000A1000-memory.dmpFilesize
132KB
-
memory/984-73-0x0000000000000000-mapping.dmp
-
memory/1064-68-0x0000000000000000-mapping.dmp
-
memory/1064-71-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1080-65-0x0000000000000000-mapping.dmp
-
memory/1396-63-0x0000000000000000-mapping.dmp
-
memory/1624-54-0x000007FEFC401000-0x000007FEFC403000-memory.dmpFilesize
8KB
-
memory/1716-76-0x0000000000000000-mapping.dmp
-
memory/1748-77-0x0000000000000000-mapping.dmp