Analysis
-
max time kernel
4294220s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
20-03-2022 06:19
Static task
static1
Behavioral task
behavioral1
Sample
263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll
Resource
win7-20220310-en
General
-
Target
263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll
-
Size
600KB
-
MD5
91e8fcdf6706c6afa6541aa71ff62016
-
SHA1
b2df07d1ed4a2345768da9c42768d1e9edfcbb52
-
SHA256
263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917
-
SHA512
7e9b55d43aa533b8b7780a1fce53985fcd76295d88e69c82dad185f3482c224301745d397f1d9e1cdde0702cb6f803227cf0b313e44c0f271944a5af4d07e873
Malware Config
Extracted
qakbot
401.138
abc114
1608108680
89.240.164.40:2222
80.195.103.146:2222
39.32.147.77:995
95.76.27.6:443
24.138.75.11:443
124.29.232.108:443
2.51.240.250:995
79.129.252.62:2222
5.193.148.126:2078
84.247.55.190:8443
2.50.159.19:2222
37.105.7.219:995
196.204.207.111:443
184.179.14.130:22
203.106.116.190:443
155.186.9.160:443
202.141.225.158:443
172.87.157.235:3389
81.133.234.36:2222
2.91.9.248:443
85.52.72.32:2222
41.205.16.222:443
93.148.241.179:2222
103.87.29.129:443
2.50.49.18:22
83.110.243.101:443
216.201.162.158:443
109.106.69.138:2222
41.228.211.33:443
197.135.137.244:443
78.96.199.79:443
213.60.147.140:443
73.156.64.203:443
45.77.115.208:8443
42.201.228.106:995
149.28.101.90:8443
84.117.176.32:443
2.50.54.35:443
110.142.205.182:443
2.50.2.216:443
72.36.59.46:2222
105.198.236.99:443
81.150.181.168:2222
83.110.13.182:2222
58.152.9.133:443
83.110.250.71:995
2.88.1.76:995
66.25.168.167:2222
118.100.159.27:443
68.225.60.77:995
219.76.148.249:443
74.195.52.3:443
41.97.85.84:443
212.139.62.210:995
37.211.23.45:995
59.99.36.216:443
71.67.24.178:2222
93.177.144.236:443
185.163.221.77:2222
90.101.62.189:2222
102.185.13.89:443
2.50.127.143:2222
176.58.134.86:2222
35.139.242.207:443
45.77.115.208:443
62.38.114.12:2222
85.72.255.119:2222
59.99.36.20:443
5.193.106.230:2078
108.190.194.146:2222
47.138.204.19:443
41.233.152.232:993
196.151.252.84:443
217.133.54.140:32100
217.128.117.218:2222
83.110.109.78:2222
93.86.1.159:995
24.205.42.241:443
120.150.34.178:443
118.160.162.244:443
47.44.217.98:443
91.138.177.114:2222
193.81.173.100:995
90.53.103.26:2222
197.161.154.132:443
189.252.113.69:995
197.45.110.165:995
2.232.253.79:995
120.57.76.77:443
185.246.9.69:995
105.198.236.101:443
68.83.89.188:443
189.150.111.8:2222
37.21.231.245:995
109.154.79.222:2222
190.220.8.10:995
78.101.130.59:995
134.228.24.29:443
45.250.69.150:443
71.117.132.169:443
45.118.65.34:443
109.205.204.229:2222
140.82.49.12:443
86.127.22.190:443
197.49.109.229:995
90.201.21.58:443
31.5.21.66:995
79.117.33.194:443
45.118.216.157:443
149.28.99.97:995
45.63.107.192:995
149.28.98.196:995
149.28.99.97:2222
144.202.38.185:2222
45.77.115.208:995
144.202.38.185:443
45.63.107.192:443
149.28.101.90:2222
45.63.107.192:2222
149.28.98.196:2222
144.202.38.185:995
149.28.98.196:443
149.28.99.97:443
149.28.101.90:995
24.122.0.90:443
68.131.19.52:443
111.95.212.237:2222
67.141.11.98:443
89.137.77.237:443
71.227.104.81:443
86.121.43.200:443
2.91.235.94:443
5.204.148.208:995
39.36.112.67:995
78.187.125.116:2222
41.199.175.138:995
81.97.154.100:443
106.250.150.98:443
80.227.5.70:443
78.101.158.1:61201
123.136.59.45:443
116.240.78.45:995
75.67.192.125:443
161.142.217.62:443
173.173.1.164:443
151.60.38.21:443
5.2.212.254:443
2.50.3.64:995
2.49.219.254:22
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1700 rundll32.exe 1700 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1700 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 616 wrote to memory of 1700 616 rundll32.exe rundll32.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 1700 wrote to memory of 804 1700 rundll32.exe explorer.exe PID 804 wrote to memory of 1956 804 explorer.exe schtasks.exe PID 804 wrote to memory of 1956 804 explorer.exe schtasks.exe PID 804 wrote to memory of 1956 804 explorer.exe schtasks.exe PID 804 wrote to memory of 1956 804 explorer.exe schtasks.exe PID 1352 wrote to memory of 1044 1352 taskeng.exe regsvr32.exe PID 1352 wrote to memory of 1044 1352 taskeng.exe regsvr32.exe PID 1352 wrote to memory of 1044 1352 taskeng.exe regsvr32.exe PID 1352 wrote to memory of 1044 1352 taskeng.exe regsvr32.exe PID 1352 wrote to memory of 1044 1352 taskeng.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe PID 1044 wrote to memory of 552 1044 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vngkxenqgx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll\"" /SC ONCE /Z /ST 22:37 /ET 22:494⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C64AE977-0B3D-403A-84A4-7AF5474B5375} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\263018d274b66a6c4b70387be645ae164ea833de8a2505b76eb90b3899bfe917.dllMD5
bb703e74a6799891dcde14874bfc45ff
SHA1cd4fc3950dd6bb56934945147c3171dd45511181
SHA2569988c0865a5f03771d630264051c55406096001dabdba835c6e9617e302f6e93
SHA5120486ffee120b8b2ba035889e674014ae5c1ee7a491c59a776fda24ea4c3a72e60d4d98d396c632a9c2d7912a57aa7270a6a874a50793a358cdb320ac51171fed
-
memory/804-57-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/804-60-0x00000000741D1000-0x00000000741D3000-memory.dmpFilesize
8KB
-
memory/804-61-0x00000000003E0000-0x0000000000661000-memory.dmpFilesize
2.5MB
-
memory/804-62-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/1044-63-0x000007FEFB851000-0x000007FEFB853000-memory.dmpFilesize
8KB
-
memory/1700-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1700-55-0x00000000006D0000-0x0000000000733000-memory.dmpFilesize
396KB
-
memory/1700-56-0x0000000010000000-0x0000000010098000-memory.dmpFilesize
608KB