Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10-06-2022 04:54
Static task
static1
Behavioral task
behavioral1
Sample
local.dll
Resource
win7-20220414-en
General
-
Target
local.dll
-
Size
843KB
-
MD5
50b13384387bdd3b6bb05a81a8a1822b
-
SHA1
3fcdf30622a4f9e81ef1c72cd3a000c6cf1c2ea0
-
SHA256
8fc0f803beb1a3c3bde04002a0a75868cf82ae0b5509da1724d9c342397c2540
-
SHA512
51abbb8913c1ac4233e82901230315bffb8af6a3e591a919f51f4a07ce57936329962125baa16f6dc916c98298513a8ea15554c81b47135588583d618ad33748
Malware Config
Extracted
qakbot
403.688
obama187
1654695312
197.164.182.46:993
70.51.135.90:2222
187.251.132.144:22
37.186.54.254:995
80.11.74.81:2222
41.84.236.245:995
24.139.72.117:443
177.94.57.126:32101
37.34.253.233:443
186.90.153.162:2222
32.221.224.140:995
208.107.221.224:443
67.165.206.193:993
63.143.92.99:995
88.232.220.207:443
189.78.107.163:32101
74.14.5.179:2222
148.0.56.63:443
40.134.246.185:995
173.21.10.71:2222
124.40.244.115:2222
24.55.67.176:443
39.44.164.54:995
102.182.232.3:995
39.49.101.104:995
31.35.28.29:443
120.150.218.241:995
197.89.128.201:443
31.48.174.63:2078
173.174.216.62:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
92.132.172.197:2222
179.158.105.44:443
1.161.123.53:443
91.177.173.10:995
217.128.122.65:2222
144.202.3.39:995
144.202.2.175:443
45.76.167.26:995
149.28.238.199:995
140.82.63.183:995
140.82.63.183:443
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
144.202.3.39:443
144.202.2.175:995
45.63.1.12:995
109.12.111.14:443
84.241.8.23:32103
104.34.212.7:32103
108.60.213.141:443
117.248.109.38:21
217.165.109.10:993
82.152.39.39:443
47.23.89.60:993
176.67.56.94:443
148.64.96.100:443
76.70.9.169:2222
182.191.92.203:995
37.210.170.123:2222
202.134.152.2:2222
89.101.97.139:443
86.195.158.178:2222
140.82.49.12:443
93.48.80.198:995
187.207.131.50:61202
191.34.120.8:443
37.208.135.172:6883
75.99.168.194:61201
5.32.41.45:443
120.61.1.225:443
101.51.77.238:443
1.161.123.53:995
86.97.9.190:443
175.145.235.37:443
39.44.235.10:995
196.203.37.215:80
41.38.167.179:995
39.41.17.134:995
58.105.167.36:50000
39.52.119.141:995
76.25.142.196:443
73.151.236.31:443
96.37.113.36:993
174.69.215.101:443
201.142.177.168:443
85.246.82.244:443
201.145.165.25:443
201.172.23.68:2222
72.252.157.93:995
190.252.242.69:443
45.46.53.140:2222
79.80.80.29:2222
72.252.157.93:990
72.27.33.160:443
72.252.157.93:993
90.120.65.153:2078
201.103.141.2:443
69.14.172.24:443
31.215.185.26:2222
191.112.12.128:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
210.246.4.69:995
83.110.92.106:443
180.129.108.214:995
47.157.227.70:443
89.86.33.217:443
177.156.191.231:443
94.36.193.176:2222
217.164.121.161:1194
86.98.149.168:2222
103.207.85.38:995
172.115.177.204:2222
105.27.172.6:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
5.203.199.157:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Egwuobje = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Eerzodm = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1052 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\a422c32c = c6fb6ad8e65deea93115af9553399019abb137c930eefcd352df8f02d9e764b3887e0799d0ba692627e5dcda24b9cf960407895e077ecfebc7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\63d7cbbf = da5f7ada65af999a86fb5171fd1dedf430d4716d6e475d3a7982179620a9642edd162c09a2d209323498d530ee369795e8c66a8fca58bad2f027d41357b8 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\eef47c94 = a5aabfbd9bb6229314baa0478bf5968f20be81f14250f95f8391c19216752aac2b explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\db6bacda = c789cc94f26a6fac3373b3fcb0fea0d0406f8c48251dc520c98dc328dc58d3f6f68b962ad1ab6498241d40e7ffabc01434de3ed37dfdf8efabb1d7dc1d2b05e2bf3201d3abe13ec42de12d1465a2083022db894e02396723eac5a60983529d0a36a653a6e4ee32319ed649fa4ccbeac2d4f61ee01a4c5861d0681866c9dede22 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\6196ebc3 = d06d32ec43671968e0e6ff82bbd51cf8a7b5f90d7d94f47de8c5db40bc3b155e022262c92709 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\1c9ea449 = 938cc75e333f5d2b2f4c9aee568d3d329d547947e825e880fa5d3bd8006c29bd646a724abc explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\eef47c94 = a5aaa8bd9bb617e27c88f76d explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\d92a8ca6 = 2d200c83eca8d0ebda48774fc813d9fa9d5f1784bf39a140dc46d97f4291ea9ce838b0a31c195a0b30b4e2b9d2aaf914a257171c7658a52c813835f83ebd34342ba90042e88094546ac214c5 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Vwuxpoasbz\91bd1362 = 0b4c3be8fdd15c020035401207d6baa71f7e2188b1a6f872db9b49d890c0676d42047f34065beb1329d8d64d7e85bb7d06c8b2b116aa2c4390c1c061e07c4b781f1e228421db415f0bf7c58a0d797cd25c642c8d8d1e59fc371ecb967af06cb05907dee7b3b2e43482d1abdca78b explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exeregsvr32.exepid process 1664 rundll32.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1052 regsvr32.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1664 rundll32.exe 1052 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 756 wrote to memory of 1664 756 rundll32.exe rundll32.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1664 wrote to memory of 1904 1664 rundll32.exe explorer.exe PID 1904 wrote to memory of 984 1904 explorer.exe schtasks.exe PID 1904 wrote to memory of 984 1904 explorer.exe schtasks.exe PID 1904 wrote to memory of 984 1904 explorer.exe schtasks.exe PID 1904 wrote to memory of 984 1904 explorer.exe schtasks.exe PID 1880 wrote to memory of 796 1880 taskeng.exe regsvr32.exe PID 1880 wrote to memory of 796 1880 taskeng.exe regsvr32.exe PID 1880 wrote to memory of 796 1880 taskeng.exe regsvr32.exe PID 1880 wrote to memory of 796 1880 taskeng.exe regsvr32.exe PID 1880 wrote to memory of 796 1880 taskeng.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 796 wrote to memory of 1052 796 regsvr32.exe regsvr32.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 1052 wrote to memory of 852 1052 regsvr32.exe explorer.exe PID 852 wrote to memory of 516 852 explorer.exe reg.exe PID 852 wrote to memory of 516 852 explorer.exe reg.exe PID 852 wrote to memory of 516 852 explorer.exe reg.exe PID 852 wrote to memory of 516 852 explorer.exe reg.exe PID 852 wrote to memory of 1628 852 explorer.exe reg.exe PID 852 wrote to memory of 1628 852 explorer.exe reg.exe PID 852 wrote to memory of 1628 852 explorer.exe reg.exe PID 852 wrote to memory of 1628 852 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\local.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\local.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mhyitsqevd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\local.dll\"" /SC ONCE /Z /ST 06:56 /ET 07:084⤵
- Creates scheduled task(s)
PID:984
-
C:\Windows\system32\taskeng.exetaskeng.exe {A9917E0B-5CC8-44F6-9491-486F18229E98} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\local.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\local.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Eerzodm" /d "0"5⤵
- Windows security bypass
PID:516 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Egwuobje" /d "0"5⤵
- Windows security bypass
PID:1628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD550b13384387bdd3b6bb05a81a8a1822b
SHA13fcdf30622a4f9e81ef1c72cd3a000c6cf1c2ea0
SHA2568fc0f803beb1a3c3bde04002a0a75868cf82ae0b5509da1724d9c342397c2540
SHA51251abbb8913c1ac4233e82901230315bffb8af6a3e591a919f51f4a07ce57936329962125baa16f6dc916c98298513a8ea15554c81b47135588583d618ad33748
-
\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD550b13384387bdd3b6bb05a81a8a1822b
SHA13fcdf30622a4f9e81ef1c72cd3a000c6cf1c2ea0
SHA2568fc0f803beb1a3c3bde04002a0a75868cf82ae0b5509da1724d9c342397c2540
SHA51251abbb8913c1ac4233e82901230315bffb8af6a3e591a919f51f4a07ce57936329962125baa16f6dc916c98298513a8ea15554c81b47135588583d618ad33748
-
memory/516-85-0x0000000000000000-mapping.dmp
-
memory/796-70-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmpFilesize
8KB
-
memory/796-69-0x0000000000000000-mapping.dmp
-
memory/852-86-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/852-81-0x0000000000000000-mapping.dmp
-
memory/984-67-0x0000000000000000-mapping.dmp
-
memory/1052-78-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/1052-80-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/1052-84-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/1052-79-0x0000000000340000-0x0000000000372000-memory.dmpFilesize
200KB
-
memory/1052-77-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/1052-76-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/1052-75-0x0000000000B60000-0x0000000000C37000-memory.dmpFilesize
860KB
-
memory/1052-72-0x0000000000000000-mapping.dmp
-
memory/1628-87-0x0000000000000000-mapping.dmp
-
memory/1664-57-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/1664-59-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/1664-61-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/1664-54-0x0000000000000000-mapping.dmp
-
memory/1664-58-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/1664-65-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/1664-56-0x0000000000890000-0x0000000000967000-memory.dmpFilesize
860KB
-
memory/1664-55-0x00000000755B1000-0x00000000755B3000-memory.dmpFilesize
8KB
-
memory/1664-60-0x00000000003F0000-0x0000000000422000-memory.dmpFilesize
200KB
-
memory/1904-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1904-62-0x0000000000000000-mapping.dmp
-
memory/1904-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1904-64-0x0000000074691000-0x0000000074693000-memory.dmpFilesize
8KB