Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-06-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
019338921.dll
Resource
win7-20220414-en
General
-
Target
019338921.dll
-
Size
1.4MB
-
MD5
d715d0ba5bf6142888b13c40b431a8c8
-
SHA1
5b44fc16e2e8c3a09ac7b8308358dfb676e2a059
-
SHA256
51568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67
-
SHA512
5beceb359e954db9b7e9dcdb80e9e8c782f749f9cbf697a28c9fe60b30f517de2f985d87d28b49e2bc08828bc770743d41f00fa784b08b098be35b7e5ccf3a37
Malware Config
Extracted
qakbot
403.694
obama186
1654596660
67.165.206.193:993
63.143.92.99:995
74.14.5.179:2222
182.191.92.203:995
197.89.8.51:443
89.101.97.139:443
86.97.9.190:443
124.40.244.115:2222
80.11.74.81:2222
41.215.153.104:995
179.100.20.32:32101
31.35.28.29:443
202.134.152.2:2222
109.12.111.14:443
93.48.80.198:995
120.150.218.241:995
41.38.167.179:995
177.94.57.126:32101
173.174.216.62:443
1.161.101.20:443
88.224.254.172:443
82.41.63.217:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
39.44.213.68:995
84.241.8.23:32103
210.246.4.69:995
92.132.172.197:2222
91.177.173.10:995
217.128.122.65:2222
149.28.238.199:995
45.76.167.26:995
45.63.1.12:443
144.202.2.175:443
45.63.1.12:995
144.202.3.39:995
144.202.2.175:995
45.76.167.26:443
149.28.238.199:443
144.202.3.39:443
140.82.63.183:995
140.82.63.183:443
175.145.235.37:443
85.246.82.244:443
47.23.89.60:993
187.207.131.50:61202
176.67.56.94:443
148.64.96.100:443
140.82.49.12:443
76.70.9.169:2222
217.164.121.161:2222
72.27.33.160:443
108.60.213.141:443
104.34.212.7:32103
39.44.158.215:995
31.48.174.63:2078
75.99.168.194:61201
117.248.109.38:21
83.110.218.147:993
82.152.39.39:443
180.129.108.214:995
5.32.41.45:443
83.110.92.106:443
197.164.182.46:993
196.203.37.215:80
186.90.153.162:2222
37.186.54.254:995
89.211.179.247:2222
24.139.72.117:443
201.142.177.168:443
37.34.253.233:443
69.14.172.24:443
125.24.187.183:443
208.107.221.224:443
174.69.215.101:443
76.25.142.196:443
96.37.113.36:993
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
189.146.90.232:443
70.51.135.90:2222
190.252.242.69:443
201.145.165.25:443
47.157.227.70:443
72.252.157.93:993
177.205.155.85:443
72.252.157.93:995
187.251.132.144:22
40.134.246.185:995
24.55.67.176:443
79.80.80.29:2222
179.158.105.44:443
72.252.157.93:990
89.86.33.217:443
201.172.23.68:2222
102.182.232.3:995
177.156.191.231:443
39.49.96.122:995
94.36.193.176:2222
120.61.1.114:443
217.164.121.161:1194
39.41.29.200:995
86.195.158.178:2222
86.98.149.168:2222
1.161.101.20:995
124.109.35.32:995
172.115.177.204:2222
105.27.172.6:443
32.221.224.140:995
208.101.82.0:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
90.120.65.153:2078
5.203.199.157:995
39.52.41.80:995
148.0.56.63:443
191.112.25.187:443
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
78.101.193.241:6883
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
67.69.166.79:2222
42.228.224.249:2222
172.114.160.81:995
94.26.122.9:995
75.99.168.194:443
189.253.206.105:443
81.215.196.174:443
46.107.48.202:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1440 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exeregsvr32.exepid process 1656 rundll32.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1356 explorer.exe 1440 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1656 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 2016 wrote to memory of 1656 2016 rundll32.exe rundll32.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1656 wrote to memory of 1356 1656 rundll32.exe explorer.exe PID 1356 wrote to memory of 836 1356 explorer.exe schtasks.exe PID 1356 wrote to memory of 836 1356 explorer.exe schtasks.exe PID 1356 wrote to memory of 836 1356 explorer.exe schtasks.exe PID 1356 wrote to memory of 836 1356 explorer.exe schtasks.exe PID 1584 wrote to memory of 1316 1584 taskeng.exe regsvr32.exe PID 1584 wrote to memory of 1316 1584 taskeng.exe regsvr32.exe PID 1584 wrote to memory of 1316 1584 taskeng.exe regsvr32.exe PID 1584 wrote to memory of 1316 1584 taskeng.exe regsvr32.exe PID 1584 wrote to memory of 1316 1584 taskeng.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe PID 1316 wrote to memory of 1440 1316 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vdzimgcym /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\019338921.dll\"" /SC ONCE /Z /ST 11:25 /ET 11:374⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {9B371548-F8F2-450A-A9F5-8B9707C32BCD} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\019338921.dllFilesize
1.4MB
MD5d715d0ba5bf6142888b13c40b431a8c8
SHA15b44fc16e2e8c3a09ac7b8308358dfb676e2a059
SHA25651568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67
SHA5125beceb359e954db9b7e9dcdb80e9e8c782f749f9cbf697a28c9fe60b30f517de2f985d87d28b49e2bc08828bc770743d41f00fa784b08b098be35b7e5ccf3a37
-
\Users\Admin\AppData\Local\Temp\019338921.dllFilesize
1.4MB
MD5d715d0ba5bf6142888b13c40b431a8c8
SHA15b44fc16e2e8c3a09ac7b8308358dfb676e2a059
SHA25651568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67
SHA5125beceb359e954db9b7e9dcdb80e9e8c782f749f9cbf697a28c9fe60b30f517de2f985d87d28b49e2bc08828bc770743d41f00fa784b08b098be35b7e5ccf3a37
-
memory/836-67-0x0000000000000000-mapping.dmp
-
memory/1316-70-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmpFilesize
8KB
-
memory/1316-69-0x0000000000000000-mapping.dmp
-
memory/1356-64-0x00000000747D1000-0x00000000747D3000-memory.dmpFilesize
8KB
-
memory/1356-68-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/1356-66-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/1356-62-0x0000000000000000-mapping.dmp
-
memory/1440-80-0x0000000000330000-0x0000000000352000-memory.dmpFilesize
136KB
-
memory/1440-72-0x0000000000000000-mapping.dmp
-
memory/1440-79-0x00000000001E0000-0x000000000020D000-memory.dmpFilesize
180KB
-
memory/1440-77-0x0000000000330000-0x0000000000352000-memory.dmpFilesize
136KB
-
memory/1440-78-0x0000000000330000-0x0000000000352000-memory.dmpFilesize
136KB
-
memory/1440-76-0x0000000000330000-0x0000000000352000-memory.dmpFilesize
136KB
-
memory/1440-75-0x0000000000BF0000-0x0000000000D55000-memory.dmpFilesize
1.4MB
-
memory/1656-57-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/1656-56-0x0000000000A80000-0x0000000000BE5000-memory.dmpFilesize
1.4MB
-
memory/1656-55-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/1656-59-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/1656-60-0x0000000000230000-0x000000000025D000-memory.dmpFilesize
180KB
-
memory/1656-65-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/1656-58-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/1656-61-0x00000000003F0000-0x0000000000412000-memory.dmpFilesize
136KB
-
memory/1656-54-0x0000000000000000-mapping.dmp