Analysis
- max time kernel
125s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/02/2022, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
dxv1.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target dxv1.dll
- Size 798KB
- Sample220214-stl3ashfc2
- SHA256 aaaac7add78fd2f9eb7638559958432498ed11480acf706d6023923fc75a48ec
- MD5 a10a2c494cac5eafccee74cc73648646
- SHA1 1f33182c46d587c40e642874ccb6001bdc86bba5
- SHA512 c233b3f08686c92207a7a93b963bf4cfe094be471bcd0264c8f2b0a2d113ffe9eecf6996f7c9dbeb1a8d1301035572fd915c78efaa55e38090bc71ae35211c2e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
qakbot
Attributes
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1352 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4032 regsvr32.exe 4032 regsvr32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4032 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3744 svchost.exe Token: SeCreatePagefilePrivilege 3744 svchost.exe Token: SeShutdownPrivilege 3744 svchost.exe Token: SeCreatePagefilePrivilege 3744 svchost.exe Token: SeShutdownPrivilege 3744 svchost.exe Token: SeCreatePagefilePrivilege 3744 svchost.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe Token: SeRestorePrivilege 4480 TiWorker.exe Token: SeSecurityPrivilege 4480 TiWorker.exe Token: SeBackupPrivilege 4480 TiWorker.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4032 3660 regsvr32.exe 82 PID 3660 wrote to memory of 4032 3660 regsvr32.exe 82 PID 3660 wrote to memory of 4032 3660 regsvr32.exe 82 PID 4032 wrote to memory of 4364 4032 regsvr32.exe 101 PID 4032 wrote to memory of 4364 4032 regsvr32.exe 101 PID 4032 wrote to memory of 4364 4032 regsvr32.exe 101 PID 4032 wrote to memory of 4364 4032 regsvr32.exe 101 PID 4032 wrote to memory of 4364 4032 regsvr32.exe 101 PID 4364 wrote to memory of 1352 4364 explorer.exe 102 PID 4364 wrote to memory of 1352 4364 explorer.exe 102 PID 4364 wrote to memory of 1352 4364 explorer.exe 102
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dxv1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dxv1.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dbimcpffw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\dxv1.dll\"" /SC ONCE /Z /ST 15:28 /ET 15:404⤵
- Creates scheduled task(s)
PID:1352
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4480