Analysis
-
max time kernel
152s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-12-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll
Resource
win7-en-20211208
General
-
Target
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll
-
Size
959KB
-
MD5
e5ef2b91bcdb8037bb2465c84c28248b
-
SHA1
adaad69a8641a607d7fc77c7cd11d6981c8afde0
-
SHA256
bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
-
SHA512
66c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1416 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\34e30f6c = 67cb68f558a4196334 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\17cdf22 = 940b463a1e5af66f7761b12d9176ec1d718a45df059805eb55b66630e4bfde718560bf73bd22d00c9ce135f9322e40957b7736742042b7aeb98ea5d11143cc4d59b408ba9feb30c53cda0776eb6ffb41d848989e85d9c835c8778a5840238d6cfda42d1932f0475436b9d1b488bbf009e0d06c087ad1174c927831c9cc0d6ebd63930961170f2fb000a5bd3d22995bcff02c930bfcb6327766f14cd797dcfd3055346e1a521888d8e1e352ddc7dbde867eb0fd6ca65a695abaac824b36e60840c9f5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\33dff5e = 698a50a70003d58c4fc798ef214b614d689a655c84286f59d890373d7345418a0727faa0c239143412ed057fab871eb4b50550034d47339ec6d8404a1b360531bb240721daed68c288f72e31e85770b0 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\bb81983b = 88d1ce25d49a980d061770687c48b0b3e8dbdf34acf324126d5a50a7cf98f6bb2ffa44bcaae31e2b7b32e8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\c689d7b1 = 8ed9db720a320a783fcbb642e838bd745db41185a2b5632901e8666cff99245864ba9a563e0e420f58df79e24077f83697406f8dfa72ca3ba0 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\b9c0b847 = 326072731f46fa83bc0a52060ea1b6a8d6b6e40778c03b11ed4cbb43e8f5f3a8028311006ab51fd5d19a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\4baa609a = fd93f161e8667eca1d310f8e08b5ab94539acb30227a4c8ebf560f9f90792dfc441c144d8117 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\34e30f6c = 67cb7ff558a42cdbcb7221e65686c6328f7938b02cb9a3b9eba2d7fcdcc7 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ouzucuhftufmos\7e35b0d4 = ebc5080317d5b8ba1c370e2fcc17bfa72dde73e3344dfa9d3360d7a1c211b4cd7350e611d2517e30f719b901637b2247ea8fd2fc6dd4aac628aacf052a1519373f7097642b0c0368754e124c5efaa48122773335f528dd9a1a7bfdeb explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1316 regsvr32.exe 1316 regsvr32.exe 1416 regsvr32.exe 1416 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1316 regsvr32.exe 1416 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2960 wrote to memory of 1316 2960 regsvr32.exe regsvr32.exe PID 2960 wrote to memory of 1316 2960 regsvr32.exe regsvr32.exe PID 2960 wrote to memory of 1316 2960 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 492 1316 regsvr32.exe explorer.exe PID 1316 wrote to memory of 492 1316 regsvr32.exe explorer.exe PID 1316 wrote to memory of 492 1316 regsvr32.exe explorer.exe PID 1316 wrote to memory of 492 1316 regsvr32.exe explorer.exe PID 1316 wrote to memory of 492 1316 regsvr32.exe explorer.exe PID 492 wrote to memory of 1532 492 explorer.exe schtasks.exe PID 492 wrote to memory of 1532 492 explorer.exe schtasks.exe PID 492 wrote to memory of 1532 492 explorer.exe schtasks.exe PID 3732 wrote to memory of 1416 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 1416 3732 regsvr32.exe regsvr32.exe PID 3732 wrote to memory of 1416 3732 regsvr32.exe regsvr32.exe PID 1416 wrote to memory of 3760 1416 regsvr32.exe explorer.exe PID 1416 wrote to memory of 3760 1416 regsvr32.exe explorer.exe PID 1416 wrote to memory of 3760 1416 regsvr32.exe explorer.exe PID 1416 wrote to memory of 3760 1416 regsvr32.exe explorer.exe PID 1416 wrote to memory of 3760 1416 regsvr32.exe explorer.exe PID 3760 wrote to memory of 2832 3760 explorer.exe reg.exe PID 3760 wrote to memory of 2832 3760 explorer.exe reg.exe PID 3760 wrote to memory of 1076 3760 explorer.exe reg.exe PID 3760 wrote to memory of 1076 3760 explorer.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uwywepba /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll\"" /SC ONCE /Z /ST 13:02 /ET 13:144⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xbhkefmhjjeq" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ggkus" /d "0"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dllMD5
e5ef2b91bcdb8037bb2465c84c28248b
SHA1adaad69a8641a607d7fc77c7cd11d6981c8afde0
SHA256bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
SHA51266c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
-
\Users\Admin\AppData\Local\Temp\bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad.dllMD5
e5ef2b91bcdb8037bb2465c84c28248b
SHA1adaad69a8641a607d7fc77c7cd11d6981c8afde0
SHA256bef46e00b74c84f8c4e22ec59705da188ac9b417f57f98239e0befa44700a7ad
SHA51266c38499678ca3e21b4dfe9e91934357b3c85c542a1774ee98411660f64d7aa05d718c3095e33280275df631833dd0607ee3a40cd06b8abb754d97132bb7700c
-
memory/492-121-0x0000000000000000-mapping.dmp
-
memory/492-123-0x0000000003810000-0x0000000003811000-memory.dmpFilesize
4KB
-
memory/492-124-0x0000000003810000-0x0000000003811000-memory.dmpFilesize
4KB
-
memory/492-125-0x0000000000EE0000-0x0000000000F01000-memory.dmpFilesize
132KB
-
memory/1076-132-0x0000000000000000-mapping.dmp
-
memory/1316-119-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1316-120-0x0000000010000000-0x00000000100F5000-memory.dmpFilesize
980KB
-
memory/1316-118-0x0000000000000000-mapping.dmp
-
memory/1416-127-0x0000000000000000-mapping.dmp
-
memory/1416-129-0x00000000031D0000-0x00000000031F3000-memory.dmpFilesize
140KB
-
memory/1532-122-0x0000000000000000-mapping.dmp
-
memory/2832-131-0x0000000000000000-mapping.dmp
-
memory/3760-130-0x0000000000000000-mapping.dmp
-
memory/3760-134-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/3760-133-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/3760-135-0x0000000000110000-0x0000000000131000-memory.dmpFilesize
132KB