Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-06-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll
Resource
win7-20220414-en
General
-
Target
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll
-
Size
1.0MB
-
MD5
6cff5dbdfc5ecc92843d23ead14452ca
-
SHA1
513c0cfab63ac8b44f7e17bbdeac831674024b46
-
SHA256
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
-
SHA512
0187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
Malware Config
Extracted
qakbot
403.688
obama189
1655107308
91.177.173.10:995
117.248.109.38:21
182.191.92.203:995
39.52.38.164:995
217.165.84.253:993
84.241.8.23:32103
82.152.39.39:443
202.134.152.2:2222
122.118.131.132:995
120.150.218.241:995
222.169.71.98:2222
37.34.253.233:443
93.48.80.198:995
148.0.55.173:443
175.145.235.37:443
41.130.140.32:993
120.61.0.71:443
89.101.97.139:443
62.204.41.187:443
62.204.41.187:2222
62.204.41.187:61201
67.209.195.198:443
80.11.74.81:2222
92.132.172.197:2222
41.84.249.88:995
39.41.116.234:995
67.165.206.193:993
173.21.10.71:2222
148.64.96.100:443
172.115.177.204:2222
186.90.153.162:2222
32.221.224.140:995
108.60.213.141:443
63.143.92.99:995
24.43.99.75:443
174.69.215.101:443
85.101.222.204:443
76.25.142.196:443
39.44.146.220:995
5.32.41.45:443
1.161.123.53:995
74.14.5.179:2222
62.204.41.187:995
24.178.196.158:2222
83.110.92.106:443
86.97.9.190:443
41.228.22.180:443
38.70.253.226:2222
47.23.89.60:993
45.46.53.140:2222
82.41.63.217:443
173.174.216.62:443
189.223.102.22:443
69.14.172.24:443
102.182.232.3:995
86.97.247.161:1194
94.36.193.176:2222
200.100.126.210:32101
114.137.226.124:443
104.34.212.7:32103
41.38.167.179:995
37.210.156.247:2222
86.195.158.178:2222
187.149.236.5:443
201.172.23.68:2222
70.51.135.90:2222
77.200.155.99:443
191.112.21.157:443
179.158.105.44:443
125.24.187.231:443
180.129.108.214:995
39.44.235.10:995
109.228.220.196:443
39.49.82.115:995
58.105.167.36:50000
190.252.242.69:443
197.94.94.206:443
62.204.41.187:990
191.34.120.8:443
72.252.157.93:993
201.1.202.82:32101
187.207.131.50:61202
76.70.9.169:2222
62.204.41.187:80
62.204.41.187:2078
189.253.206.105:443
176.67.56.94:443
103.116.178.85:995
197.87.182.115:443
143.0.219.6:995
109.12.111.14:443
189.146.87.77:443
47.157.227.70:443
24.139.72.117:443
79.80.80.29:2222
187.189.168.121:22
193.136.1.58:443
37.186.54.96:995
40.134.246.185:995
90.120.209.197:2078
96.37.113.36:993
86.97.247.161:2222
37.208.135.172:6883
72.27.33.160:443
208.101.82.0:443
89.86.33.217:443
189.37.80.240:443
86.98.149.168:2222
103.207.85.38:995
71.24.118.253:443
217.165.176.49:2222
109.178.178.110:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1508 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exeregsvr32.exepid process 1596 rundll32.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1200 explorer.exe 1508 regsvr32.exe 1200 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1596 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1528 wrote to memory of 1596 1528 rundll32.exe rundll32.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1596 wrote to memory of 1200 1596 rundll32.exe explorer.exe PID 1200 wrote to memory of 1704 1200 explorer.exe schtasks.exe PID 1200 wrote to memory of 1704 1200 explorer.exe schtasks.exe PID 1200 wrote to memory of 1704 1200 explorer.exe schtasks.exe PID 1200 wrote to memory of 1704 1200 explorer.exe schtasks.exe PID 1052 wrote to memory of 1172 1052 taskeng.exe regsvr32.exe PID 1052 wrote to memory of 1172 1052 taskeng.exe regsvr32.exe PID 1052 wrote to memory of 1172 1052 taskeng.exe regsvr32.exe PID 1052 wrote to memory of 1172 1052 taskeng.exe regsvr32.exe PID 1052 wrote to memory of 1172 1052 taskeng.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1508 1172 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kacomdh /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll\"" /SC ONCE /Z /ST 17:02 /ET 17:144⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {41CB11BC-0901-490C-9992-745570BC09FB} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dllFilesize
1.0MB
MD56cff5dbdfc5ecc92843d23ead14452ca
SHA1513c0cfab63ac8b44f7e17bbdeac831674024b46
SHA2568f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
SHA5120187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
-
\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dllFilesize
1.0MB
MD56cff5dbdfc5ecc92843d23ead14452ca
SHA1513c0cfab63ac8b44f7e17bbdeac831674024b46
SHA2568f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
SHA5120187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
-
memory/1172-69-0x0000000000000000-mapping.dmp
-
memory/1172-70-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmpFilesize
8KB
-
memory/1200-62-0x0000000000000000-mapping.dmp
-
memory/1200-68-0x0000000000310000-0x0000000000332000-memory.dmpFilesize
136KB
-
memory/1200-66-0x0000000000310000-0x0000000000332000-memory.dmpFilesize
136KB
-
memory/1200-64-0x0000000074EF1000-0x0000000074EF3000-memory.dmpFilesize
8KB
-
memory/1508-77-0x00000000003A0000-0x00000000003C2000-memory.dmpFilesize
136KB
-
memory/1508-75-0x0000000000AA0000-0x0000000000BAC000-memory.dmpFilesize
1.0MB
-
memory/1508-72-0x0000000000000000-mapping.dmp
-
memory/1508-76-0x00000000003A0000-0x00000000003C2000-memory.dmpFilesize
136KB
-
memory/1508-78-0x00000000003A0000-0x00000000003C2000-memory.dmpFilesize
136KB
-
memory/1508-79-0x0000000000230000-0x0000000000262000-memory.dmpFilesize
200KB
-
memory/1508-80-0x00000000003A0000-0x00000000003C2000-memory.dmpFilesize
136KB
-
memory/1596-60-0x0000000000300000-0x0000000000332000-memory.dmpFilesize
200KB
-
memory/1596-65-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1596-61-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1596-54-0x0000000000000000-mapping.dmp
-
memory/1596-59-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1596-58-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1596-57-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1596-56-0x0000000000950000-0x0000000000A5C000-memory.dmpFilesize
1.0MB
-
memory/1596-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1704-67-0x0000000000000000-mapping.dmp