Overview
overview
10Static
static
10021865faa3...bf.dll
windows7_x64
10021865faa3...bf.dll
windows10-2004_x64
1026de26ea18...ff.dll
windows7_x64
1026de26ea18...ff.dll
windows10-2004_x64
10305e8e14bc...f8.dll
windows7_x64
10305e8e14bc...f8.dll
windows10-2004_x64
1047ea7ae3c9...94.dll
windows7_x64
1047ea7ae3c9...94.dll
windows10-2004_x64
1051ab9788b9...77.dll
windows7_x64
1051ab9788b9...77.dll
windows10-2004_x64
10587547a79f...fd.dll
windows7_x64
10587547a79f...fd.dll
windows10-2004_x64
1058878537dc...14.dll
windows7_x64
1058878537dc...14.dll
windows10-2004_x64
106909c2801f...37.dll
windows7_x64
106909c2801f...37.dll
windows10-2004_x64
1069ac3f3a76...85.dll
windows7_x64
1069ac3f3a76...85.dll
windows10-2004_x64
106ce8fbedc5...f2.dll
windows7_x64
106ce8fbedc5...f2.dll
windows10-2004_x64
107a91436b7a...0c.dll
windows7_x64
107a91436b7a...0c.dll
windows10-2004_x64
108f5843efe1...d4.dll
windows7_x64
108f5843efe1...d4.dll
windows10-2004_x64
1098d07ae48b...0b.dll
windows7_x64
1098d07ae48b...0b.dll
windows10-2004_x64
109c5c2af628...c7.dll
windows7_x64
109c5c2af628...c7.dll
windows10-2004_x64
109e00cf7d03...0d.dll
windows7_x64
109e00cf7d03...0d.dll
windows10-2004_x64
109e7db9c87f...2b.dll
windows7_x64
109e7db9c87f...2b.dll
windows10-2004_x64
10Analysis
-
max time kernel
4294202s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
14-03-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
021865faa3b24771036f065fc7bd26230e5294e471ab21334e85010b1e9196bf.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral3
Sample
26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff.dll
Resource
win7-20220311-en
Behavioral task
behavioral4
Sample
26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8.dll
Resource
win7-20220310-en
Behavioral task
behavioral6
Sample
305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94.dll
Resource
win7-20220310-en
Behavioral task
behavioral8
Sample
47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
Resource
win7-20220311-en
Behavioral task
behavioral10
Sample
51ab9788b91c7fa71567e1d3abb19f6d2542f2a75f0f11a5b2e4c1fd05387d77.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral11
Sample
587547a79fd6f8c7fb625a43b3d7f6dd24505ab86d404dd5b54d62038d9479fd.dll
Resource
win7-20220311-en
Behavioral task
behavioral12
Sample
587547a79fd6f8c7fb625a43b3d7f6dd24505ab86d404dd5b54d62038d9479fd.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll
Resource
win7-20220311-en
Behavioral task
behavioral14
Sample
58878537dcf0d621aeffb66a32a40c52fa8588c832d631b988e59673bede9914.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
Resource
win7-20220310-en
Behavioral task
behavioral16
Sample
6909c2801f5d2d0a61baa68622a31aaecaaa1bdce1911e809e9246ed616cbe37.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85.dll
Resource
win7-20220310-en
Behavioral task
behavioral18
Sample
69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
Resource
win7-20220310-en
Behavioral task
behavioral20
Sample
6ce8fbedc5fd65785ce950cd2c6e670f89c6f3e9cdd41d6abcf86b61eee911f2.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral21
Sample
7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll
Resource
win7-20220310-en
Behavioral task
behavioral22
Sample
7a91436b7a51dfd164632e7da459c4fb35f8edfea1dea8c438ee75e3f2e0400c.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral23
Sample
8f5843efe1c817ec78ecc53206b70df0badb70dda8cfdb18fefd2ab9bff0e9d4.dll
Resource
win7-20220311-en
Behavioral task
behavioral24
Sample
8f5843efe1c817ec78ecc53206b70df0badb70dda8cfdb18fefd2ab9bff0e9d4.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral25
Sample
98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
Resource
win7-20220310-en
Behavioral task
behavioral26
Sample
98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral27
Sample
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll
Resource
win7-20220311-en
Behavioral task
behavioral28
Sample
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
Resource
win7-20220310-en
Behavioral task
behavioral30
Sample
9e00cf7d03bf640ddd50390008308926ae82f906ece239e65f628182086e030d.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral31
Sample
9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll
Resource
win7-20220310-en
General
-
Target
9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll
-
Size
280KB
-
MD5
3f0a6191433bb71f6c1ee5c6a9f79e20
-
SHA1
de746c17968d9d1ca33b3d3829c93efeeb780a0c
-
SHA256
9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b
-
SHA512
9bc7a8b9693b3599c817924888a48ea58ccbf51d897a167db020fde805099434b02ea0ea8c795c74cb9cde501f196c87af7cc7a3eb0798684f627ac485c7fbda
Malware Config
Extracted
qakbot
402.115
obama64
1624560446
140.82.49.12:443
81.214.126.173:2222
75.67.192.125:443
216.201.162.158:443
76.25.142.196:443
68.186.192.69:443
95.77.223.148:443
97.69.160.4:2222
71.41.184.10:3389
184.185.103.157:443
189.210.115.207:443
24.179.77.236:443
73.151.236.31:443
188.26.180.140:443
213.122.113.120:443
75.137.47.174:443
197.45.110.165:995
72.240.200.181:2222
75.188.35.168:443
173.21.10.71:2222
24.55.112.61:443
151.205.102.42:443
186.144.33.73:443
149.28.98.196:995
45.63.107.192:995
45.63.107.192:443
149.28.101.90:443
45.32.211.207:995
149.28.98.196:2222
149.28.99.97:443
149.28.101.90:8443
45.32.211.207:8443
149.28.99.97:995
45.32.211.207:2222
45.77.117.108:2222
207.246.77.75:8443
149.28.99.97:2222
96.253.46.210:443
193.248.221.184:2222
92.59.35.196:2222
144.139.47.206:443
86.220.60.247:2222
90.65.234.26:2222
105.198.236.99:443
24.139.72.117:443
24.229.150.54:995
105.198.236.101:443
68.204.7.158:443
47.22.148.6:443
149.28.98.196:443
149.28.101.90:2222
45.32.211.207:443
144.202.38.185:2222
45.77.115.208:8443
207.246.77.75:995
45.77.117.108:8443
109.12.111.14:443
45.77.115.208:443
207.246.77.75:443
144.202.38.185:995
144.202.38.185:443
207.246.77.75:2222
45.77.115.208:2222
45.77.117.108:995
149.28.101.90:995
45.77.115.208:995
45.77.117.108:443
83.110.109.155:2222
45.46.53.140:2222
72.252.201.69:443
136.232.34.70:443
71.74.12.34:443
50.29.166.232:995
175.136.38.142:443
222.153.122.173:995
100.2.20.137:443
67.165.206.193:993
83.196.56.65:2222
98.192.185.86:443
46.149.81.250:443
207.246.116.237:8443
207.246.116.237:995
207.246.116.237:443
207.246.116.237:2222
45.63.107.192:2222
71.163.222.223:443
98.252.118.134:443
96.37.113.36:993
27.223.92.142:995
24.152.219.253:995
24.95.61.62:443
96.61.23.88:995
172.78.33.243:443
92.96.3.180:2078
71.187.170.235:443
50.244.112.106:443
24.122.166.173:443
73.25.124.140:2222
47.196.213.73:443
186.154.175.13:443
70.163.161.79:443
78.63.226.32:443
76.168.147.166:993
64.121.114.87:443
77.27.207.217:995
31.4.242.233:995
125.62.192.220:443
195.12.154.8:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1940 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1964 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1964 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 1964 1988 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1964 wrote to memory of 1672 1964 rundll32.exe explorer.exe PID 1672 wrote to memory of 1472 1672 explorer.exe schtasks.exe PID 1672 wrote to memory of 1472 1672 explorer.exe schtasks.exe PID 1672 wrote to memory of 1472 1672 explorer.exe schtasks.exe PID 1672 wrote to memory of 1472 1672 explorer.exe schtasks.exe PID 2020 wrote to memory of 1804 2020 taskeng.exe regsvr32.exe PID 2020 wrote to memory of 1804 2020 taskeng.exe regsvr32.exe PID 2020 wrote to memory of 1804 2020 taskeng.exe regsvr32.exe PID 2020 wrote to memory of 1804 2020 taskeng.exe regsvr32.exe PID 2020 wrote to memory of 1804 2020 taskeng.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe PID 1804 wrote to memory of 1940 1804 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qfjgojt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll\"" /SC ONCE /Z /ST 12:25 /ET 12:374⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {5EC42AFD-DF22-41D1-9F71-961CC4EB4306} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dll"3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dllMD5
202047babe6d68b81be682af36618cc6
SHA194b2ade4ce5038f623212bc0d8d9c41cb59064aa
SHA256812f67342092a3c6179753af55cb2248e347d13c9178c6ffd10671b2b88327cc
SHA5120ada56239da2c8618d96c53c457fe7ee93596f248085a238ad4f5b7815e15510ca928de59305528b824dae1c08c4c00906dc9aef1890f401cac47b756b379223
-
\Users\Admin\AppData\Local\Temp\9e7db9c87fc4374a2c88cc5f1bdc540205e161423010b2ee826b88b7b3503f2b.dllMD5
202047babe6d68b81be682af36618cc6
SHA194b2ade4ce5038f623212bc0d8d9c41cb59064aa
SHA256812f67342092a3c6179753af55cb2248e347d13c9178c6ffd10671b2b88327cc
SHA5120ada56239da2c8618d96c53c457fe7ee93596f248085a238ad4f5b7815e15510ca928de59305528b824dae1c08c4c00906dc9aef1890f401cac47b756b379223
-
memory/1672-57-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1672-60-0x0000000074581000-0x0000000074583000-memory.dmpFilesize
8KB
-
memory/1672-61-0x00000000007D0000-0x0000000000A51000-memory.dmpFilesize
2.5MB
-
memory/1672-62-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1804-63-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmpFilesize
8KB
-
memory/1964-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1964-55-0x00000000001C0000-0x0000000000209000-memory.dmpFilesize
292KB
-
memory/1964-56-0x0000000010000000-0x0000000010049000-memory.dmpFilesize
292KB