Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-12-2021 14:18
Static task
static1
Behavioral task
behavioral1
Sample
60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll
Resource
win7-en-20211208
General
-
Target
60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll
-
Size
934KB
-
MD5
ea4f783d466e757560776d148a790709
-
SHA1
5beac9e9677e5bec28655ab09ad013311be9572e
-
SHA256
60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9
-
SHA512
2971dbc30fbfc4939e17c0ac3dd1d419ce93f13a20dde5700e8ce4352a8373d326d346befe8c87929f2b71c906dc6fa5ef32858ff3c944f756df6ed841aa693f
Malware Config
Extracted
qakbot
403.10
cullinan
1639333530
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 324 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4048 regsvr32.exe 4048 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4048 regsvr32.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
Processes:
regsvr32.exepid process 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe -
Suspicious use of SendNotifyMessage 31 IoCs
Processes:
regsvr32.exepid process 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe 4048 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exedescription pid process target process PID 3260 wrote to memory of 4048 3260 regsvr32.exe regsvr32.exe PID 3260 wrote to memory of 4048 3260 regsvr32.exe regsvr32.exe PID 3260 wrote to memory of 4048 3260 regsvr32.exe regsvr32.exe PID 4048 wrote to memory of 1280 4048 regsvr32.exe explorer.exe PID 4048 wrote to memory of 1280 4048 regsvr32.exe explorer.exe PID 4048 wrote to memory of 1280 4048 regsvr32.exe explorer.exe PID 4048 wrote to memory of 1280 4048 regsvr32.exe explorer.exe PID 4048 wrote to memory of 1280 4048 regsvr32.exe explorer.exe PID 1280 wrote to memory of 1548 1280 explorer.exe schtasks.exe PID 1280 wrote to memory of 1548 1280 explorer.exe schtasks.exe PID 1280 wrote to memory of 1548 1280 explorer.exe schtasks.exe PID 2836 wrote to memory of 324 2836 regsvr32.exe regsvr32.exe PID 2836 wrote to memory of 324 2836 regsvr32.exe regsvr32.exe PID 2836 wrote to memory of 324 2836 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dkwblvvhzu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll\"" /SC ONCE /Z /ST 06:19 /ET 06:314⤵
- Creates scheduled task(s)
PID:1548
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dll"2⤵
- Loads dropped DLL
PID:324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dllMD5
ea4f783d466e757560776d148a790709
SHA15beac9e9677e5bec28655ab09ad013311be9572e
SHA25660db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9
SHA5122971dbc30fbfc4939e17c0ac3dd1d419ce93f13a20dde5700e8ce4352a8373d326d346befe8c87929f2b71c906dc6fa5ef32858ff3c944f756df6ed841aa693f
-
\Users\Admin\AppData\Local\Temp\60db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9.dllMD5
ea4f783d466e757560776d148a790709
SHA15beac9e9677e5bec28655ab09ad013311be9572e
SHA25660db49cac9157a0e63ba7cf559fa084c5bb3fec0ba69c6a08bb85dd3ba6dbac9
SHA5122971dbc30fbfc4939e17c0ac3dd1d419ce93f13a20dde5700e8ce4352a8373d326d346befe8c87929f2b71c906dc6fa5ef32858ff3c944f756df6ed841aa693f
-
memory/324-124-0x0000000000000000-mapping.dmp
-
memory/1280-118-0x0000000000000000-mapping.dmp
-
memory/1280-120-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/1280-121-0x0000000003540000-0x0000000003541000-memory.dmpFilesize
4KB
-
memory/1280-122-0x0000000002F50000-0x0000000002F71000-memory.dmpFilesize
132KB
-
memory/1548-119-0x0000000000000000-mapping.dmp
-
memory/4048-115-0x0000000000000000-mapping.dmp
-
memory/4048-116-0x0000000004D80000-0x0000000004DA3000-memory.dmpFilesize
140KB
-
memory/4048-117-0x0000000010000000-0x00000000100F4000-memory.dmpFilesize
976KB