Analysis
-
max time kernel
4294188s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
09-03-2022 15:30
Behavioral task
behavioral1
Sample
75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll
Resource
win7-20220223-en
General
-
Target
75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll
-
Size
2.1MB
-
MD5
ff00de713a07cff7c785fef8139033cc
-
SHA1
50badd84c1d45d73adf41515240b7e4fa0cb956e
-
SHA256
75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01
-
SHA512
c129831ab8fa475743ca893d72ae734b527dba95d800e92551c2c1a68c6025b739d5d263f7a3fcb2187003adb05adc7d48fcd4ffc60417c5869bf0d046eb6ac1
Malware Config
Extracted
qakbot
401.62
notset
1607006214
96.227.127.13:443
174.20.161.243:995
83.196.50.197:2222
116.240.78.45:995
80.11.5.65:2222
181.169.88.203:443
72.252.201.69:443
94.69.242.254:2222
187.213.136.249:995
96.27.47.70:2222
78.181.19.134:443
71.182.142.63:443
178.222.114.132:995
68.134.181.98:443
172.87.134.226:443
217.133.54.140:32100
151.56.214.79:443
72.240.200.181:2222
41.233.153.21:993
87.27.110.90:2222
197.45.110.165:995
199.116.241.147:443
143.178.135.25:2222
105.101.90.203:443
105.198.236.101:443
70.118.146.154:995
86.121.3.80:443
37.106.60.237:995
67.6.54.180:443
72.28.255.159:995
50.244.112.10:995
99.244.210.10:443
86.189.252.131:2222
67.8.103.21:443
74.137.189.78:443
136.232.34.70:443
37.211.86.156:443
96.41.93.96:443
2.191.77.18:443
37.150.50.72:995
109.205.204.229:2222
173.3.106.172:2222
95.77.144.238:443
94.52.160.116:443
78.96.199.79:443
85.52.72.32:2222
208.93.202.41:443
189.231.3.63:443
24.229.150.54:995
67.40.253.209:995
73.244.83.199:443
2.90.186.243:995
196.151.252.84:443
68.15.109.125:443
189.252.62.238:995
81.97.154.100:443
83.114.243.80:2222
2.50.56.81:443
96.225.88.23:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
85.132.36.111:2222
72.36.59.46:2222
108.190.151.108:2222
120.151.95.167:443
70.45.219.126:443
78.97.110.47:443
189.90.97.134:2222
184.89.71.68:443
32.212.117.188:443
78.97.3.6:443
173.18.126.193:2222
92.59.35.196:2083
47.22.148.6:443
98.240.24.57:443
46.152.122.110:443
41.205.16.89:443
42.201.228.106:995
89.3.198.238:443
120.150.60.189:995
110.142.205.182:443
78.162.70.119:443
37.210.133.63:995
140.82.27.132:443
45.32.162.253:443
181.208.249.141:443
78.187.125.116:2222
37.234.175.105:995
45.32.165.134:443
200.75.136.78:443
67.237.68.126:2222
184.21.136.237:995
73.166.10.38:443
50.244.112.90:443
172.87.157.235:3389
37.182.244.124:2222
71.226.140.73:443
79.129.216.215:2222
92.154.83.96:2078
24.179.13.119:443
81.133.234.36:2222
71.163.223.144:443
86.98.34.84:995
73.55.254.225:443
197.135.132.247:443
65.131.47.74:995
80.14.22.234:2222
39.36.30.92:995
217.162.149.212:443
86.98.59.208:443
118.70.55.146:443
41.104.58.86:443
83.110.74.173:443
176.181.247.197:443
67.141.11.98:443
73.51.245.231:995
188.25.175.46:443
84.232.252.202:2222
85.105.29.218:443
196.204.207.111:443
201.152.69.198:995
134.228.24.29:443
108.30.125.94:443
151.75.13.83:443
68.131.19.52:443
37.116.152.122:2078
92.154.83.96:1194
94.59.236.155:995
83.110.221.218:443
92.154.83.96:2087
5.15.225.109:443
86.245.87.251:2222
41.96.167.79:443
78.63.226.32:443
93.177.172.131:443
39.32.79.66:995
85.204.189.105:443
120.150.218.241:443
41.43.94.207:995
189.157.3.12:443
98.115.243.237:443
109.115.125.81:50000
190.220.8.10:993
89.136.12.221:2222
217.128.117.218:2222
67.249.12.146:443
37.209.252.242:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1508 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1796 rundll32.exe 1796 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1796 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1116 wrote to memory of 1796 1116 rundll32.exe rundll32.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 1796 wrote to memory of 968 1796 rundll32.exe explorer.exe PID 968 wrote to memory of 664 968 explorer.exe schtasks.exe PID 968 wrote to memory of 664 968 explorer.exe schtasks.exe PID 968 wrote to memory of 664 968 explorer.exe schtasks.exe PID 968 wrote to memory of 664 968 explorer.exe schtasks.exe PID 1484 wrote to memory of 1176 1484 taskeng.exe regsvr32.exe PID 1484 wrote to memory of 1176 1484 taskeng.exe regsvr32.exe PID 1484 wrote to memory of 1176 1484 taskeng.exe regsvr32.exe PID 1484 wrote to memory of 1176 1484 taskeng.exe regsvr32.exe PID 1484 wrote to memory of 1176 1484 taskeng.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 1508 1176 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dfpmwvyh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll\"" /SC ONCE /Z /ST 15:33 /ET 15:454⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C09F9FBD-B534-4979-9D7D-28EB52EA3CDC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dllMD5
6523b4db806ac9ae567bddfc4bcd0dae
SHA103bd9c4ac900d48e227d24cbfd707c2062afc126
SHA25673333d0f1516404f5dbaec38b8cd5c58658de374ff6c3532ce099492a668027f
SHA5121a96557e2bc33cb0fc4ba5134622f7f1f12faa0835653926706fcc712d763f59ec5ab60a91bb5334ce8b53307cae8673380cf4e0a5ad1497837b2a7e30c8b749
-
\Users\Admin\AppData\Local\Temp\75fe69b3150f41b953bab2d227ac2c06a056d333be859ae28908280075eedb01.dllMD5
6523b4db806ac9ae567bddfc4bcd0dae
SHA103bd9c4ac900d48e227d24cbfd707c2062afc126
SHA25673333d0f1516404f5dbaec38b8cd5c58658de374ff6c3532ce099492a668027f
SHA5121a96557e2bc33cb0fc4ba5134622f7f1f12faa0835653926706fcc712d763f59ec5ab60a91bb5334ce8b53307cae8673380cf4e0a5ad1497837b2a7e30c8b749
-
memory/968-55-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/968-58-0x00000000745C1000-0x00000000745C3000-memory.dmpFilesize
8KB
-
memory/968-61-0x0000000000350000-0x00000000005D1000-memory.dmpFilesize
2.5MB
-
memory/968-62-0x00000000000D0000-0x00000000000F1000-memory.dmpFilesize
132KB
-
memory/1176-63-0x000007FEFB871000-0x000007FEFB873000-memory.dmpFilesize
8KB
-
memory/1796-54-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1796-59-0x0000000002240000-0x000000000242A000-memory.dmpFilesize
1.9MB
-
memory/1796-60-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB