Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-06-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll
Resource
win7-20220414-en
General
-
Target
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll
-
Size
1.0MB
-
MD5
6cff5dbdfc5ecc92843d23ead14452ca
-
SHA1
513c0cfab63ac8b44f7e17bbdeac831674024b46
-
SHA256
8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
-
SHA512
0187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
Malware Config
Extracted
qakbot
403.688
obama189
1655107308
91.177.173.10:995
117.248.109.38:21
182.191.92.203:995
39.52.38.164:995
217.165.84.253:993
84.241.8.23:32103
82.152.39.39:443
202.134.152.2:2222
122.118.131.132:995
120.150.218.241:995
222.169.71.98:2222
37.34.253.233:443
93.48.80.198:995
148.0.55.173:443
175.145.235.37:443
41.130.140.32:993
120.61.0.71:443
89.101.97.139:443
62.204.41.187:443
62.204.41.187:2222
62.204.41.187:61201
67.209.195.198:443
80.11.74.81:2222
92.132.172.197:2222
41.84.249.88:995
39.41.116.234:995
67.165.206.193:993
173.21.10.71:2222
148.64.96.100:443
172.115.177.204:2222
186.90.153.162:2222
32.221.224.140:995
108.60.213.141:443
63.143.92.99:995
24.43.99.75:443
174.69.215.101:443
85.101.222.204:443
76.25.142.196:443
39.44.146.220:995
5.32.41.45:443
1.161.123.53:995
74.14.5.179:2222
62.204.41.187:995
24.178.196.158:2222
83.110.92.106:443
86.97.9.190:443
41.228.22.180:443
38.70.253.226:2222
47.23.89.60:993
45.46.53.140:2222
82.41.63.217:443
173.174.216.62:443
189.223.102.22:443
69.14.172.24:443
102.182.232.3:995
86.97.247.161:1194
94.36.193.176:2222
200.100.126.210:32101
114.137.226.124:443
104.34.212.7:32103
41.38.167.179:995
37.210.156.247:2222
86.195.158.178:2222
187.149.236.5:443
201.172.23.68:2222
70.51.135.90:2222
77.200.155.99:443
191.112.21.157:443
179.158.105.44:443
125.24.187.231:443
180.129.108.214:995
39.44.235.10:995
109.228.220.196:443
39.49.82.115:995
58.105.167.36:50000
190.252.242.69:443
197.94.94.206:443
62.204.41.187:990
191.34.120.8:443
72.252.157.93:993
201.1.202.82:32101
187.207.131.50:61202
76.70.9.169:2222
62.204.41.187:80
62.204.41.187:2078
189.253.206.105:443
176.67.56.94:443
103.116.178.85:995
197.87.182.115:443
143.0.219.6:995
109.12.111.14:443
189.146.87.77:443
47.157.227.70:443
24.139.72.117:443
79.80.80.29:2222
187.189.168.121:22
193.136.1.58:443
37.186.54.96:995
40.134.246.185:995
90.120.209.197:2078
96.37.113.36:993
86.97.247.161:2222
37.208.135.172:6883
72.27.33.160:443
208.101.82.0:443
89.86.33.217:443
189.37.80.240:443
86.98.149.168:2222
103.207.85.38:995
71.24.118.253:443
217.165.176.49:2222
109.178.178.110:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Nacobnbvbk = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Jtivcie = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 4196 regsvr32.exe 4196 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3448 4460 WerFault.exe rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\ae4e30d1 = 2029f1a1a36b54a18180d982dca887f4c8f42c39171a55ed8afb7008de561e223868b2e9a830553175374f0378b02ca7ce12b20fc99a81787a6ac5abc0c25f6a1ff21f4a4b3ea36a0b14d46fe5b98648ca explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\212ca786 = 6e4d472fca0c4b5955c2962eb9fb0b2369eb05a874e439a6db70ee986b6ad24814fa2e832943c37d5029da90bda6a51382f1c041a88b86fb97c1781fea0cabfb explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\212ca786 = 6e4d502fca0c7e2e033f2d94eda21853a9c2180c2f4d611d34d99ca461f4e06edc457e92e319c3140e6546 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\14b377c8 = 3db4e031c0382f6caf0fdd07b0a6d43455cd6ef812cd45c079831c72ec1487f277f7babf3a77f9250322f150590fe592b70fdcfe39190ff72d5fc340ef2eb5e7b53a398d57c5f3b8f78a6f1915627cb21bef3c992335c3534bf75f3bf8fec6962a450f61d2352afd68a135c7dc148b217e15279512bb715dce915d90760418a29fde8b994c334e616779102fd4b01851f1d25392ce56 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\ac0f10ad = 9ad7bc8a6834328654daa1c482eb674b0dbceb485511de2e9c4e68fb7c705d006e61c5f3 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\5e65c870 = b4735768899aff7aae07c5aea5e48ba1d8c343cf74 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\16f257b4 = a779d4a778d8de5642a2eefbd3561e630a568dde75e9205ea25e57d0cae563733a810db1bc666ff3af2471b6727c4f0d265bc7eff3060f46e026c6f46cd9ee93af57ad03522a7545541c294237ae78e3a6bdd4060c37d88407daec75508bc08567d29cc6d88f75e7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\d3467f5b = 4b3133d9b796f8c15a972193834d39fef32dc6236234fcf8b3921dca8329476fcd8d408d98c8ac4ba4ff6ba871249a65eb1d954293c7a508871bddedc8bcafbb explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ldnyoiygiy\6bfa183e = 08b6662384e1293d022354e85aaf4de9a9cadaf6778952ba7aba37a7c93f61a699831c0d552ee1b25061d91991212f1db849ec55617daef9d3f95f12873e92e577ef9e39c3 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exepid process 4460 rundll32.exe 4460 rundll32.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 4460 rundll32.exe 4196 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1364 wrote to memory of 4460 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 4460 1364 rundll32.exe rundll32.exe PID 1364 wrote to memory of 4460 1364 rundll32.exe rundll32.exe PID 4460 wrote to memory of 4408 4460 rundll32.exe explorer.exe PID 4460 wrote to memory of 4408 4460 rundll32.exe explorer.exe PID 4460 wrote to memory of 4408 4460 rundll32.exe explorer.exe PID 4460 wrote to memory of 4408 4460 rundll32.exe explorer.exe PID 4460 wrote to memory of 4408 4460 rundll32.exe explorer.exe PID 4408 wrote to memory of 3088 4408 explorer.exe schtasks.exe PID 4408 wrote to memory of 3088 4408 explorer.exe schtasks.exe PID 4408 wrote to memory of 3088 4408 explorer.exe schtasks.exe PID 3804 wrote to memory of 4196 3804 regsvr32.exe regsvr32.exe PID 3804 wrote to memory of 4196 3804 regsvr32.exe regsvr32.exe PID 3804 wrote to memory of 4196 3804 regsvr32.exe regsvr32.exe PID 4196 wrote to memory of 1660 4196 regsvr32.exe explorer.exe PID 4196 wrote to memory of 1660 4196 regsvr32.exe explorer.exe PID 4196 wrote to memory of 1660 4196 regsvr32.exe explorer.exe PID 4196 wrote to memory of 1660 4196 regsvr32.exe explorer.exe PID 4196 wrote to memory of 1660 4196 regsvr32.exe explorer.exe PID 1660 wrote to memory of 4324 1660 explorer.exe reg.exe PID 1660 wrote to memory of 4324 1660 explorer.exe reg.exe PID 1660 wrote to memory of 1088 1660 explorer.exe reg.exe PID 1660 wrote to memory of 1088 1660 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vyksdbdo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll\"" /SC ONCE /Z /ST 17:02 /ET 17:144⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 7443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4460 -ip 44601⤵
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jtivcie" /d "0"4⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Nacobnbvbk" /d "0"4⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dllFilesize
1.0MB
MD56cff5dbdfc5ecc92843d23ead14452ca
SHA1513c0cfab63ac8b44f7e17bbdeac831674024b46
SHA2568f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
SHA5120187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
-
C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dllFilesize
1.0MB
MD56cff5dbdfc5ecc92843d23ead14452ca
SHA1513c0cfab63ac8b44f7e17bbdeac831674024b46
SHA2568f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
SHA5120187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
-
C:\Users\Admin\AppData\Local\Temp\8f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8.dllFilesize
1.0MB
MD56cff5dbdfc5ecc92843d23ead14452ca
SHA1513c0cfab63ac8b44f7e17bbdeac831674024b46
SHA2568f08ce574fd51a476bc0f4f861eafba73786fb2c3c32bf8a0cd9ffe00d01fdd8
SHA5120187ff64f59f8a85097112eb628dfa400233c4b440b7824adf005e198f04f099ce3630e38c9512df46bfc61dbf0a3abc5cf3897d867fdaf0a1d057ab65b6c256
-
memory/1088-151-0x0000000000000000-mapping.dmp
-
memory/1660-148-0x0000000000000000-mapping.dmp
-
memory/1660-153-0x0000000000C80000-0x0000000000CA2000-memory.dmpFilesize
136KB
-
memory/1660-152-0x0000000000C80000-0x0000000000CA2000-memory.dmpFilesize
136KB
-
memory/3088-138-0x0000000000000000-mapping.dmp
-
memory/4196-145-0x0000000001240000-0x0000000001262000-memory.dmpFilesize
136KB
-
memory/4196-149-0x0000000001240000-0x0000000001262000-memory.dmpFilesize
136KB
-
memory/4196-141-0x0000000000000000-mapping.dmp
-
memory/4196-147-0x0000000001240000-0x0000000001262000-memory.dmpFilesize
136KB
-
memory/4196-146-0x0000000001200000-0x0000000001232000-memory.dmpFilesize
200KB
-
memory/4196-144-0x0000000000C30000-0x0000000000D3C000-memory.dmpFilesize
1.0MB
-
memory/4324-150-0x0000000000000000-mapping.dmp
-
memory/4408-139-0x0000000000D60000-0x0000000000D82000-memory.dmpFilesize
136KB
-
memory/4408-135-0x0000000000000000-mapping.dmp
-
memory/4408-136-0x0000000000D60000-0x0000000000D82000-memory.dmpFilesize
136KB
-
memory/4460-132-0x0000000002DA0000-0x0000000002DC2000-memory.dmpFilesize
136KB
-
memory/4460-133-0x0000000002D40000-0x0000000002D72000-memory.dmpFilesize
200KB
-
memory/4460-130-0x0000000000000000-mapping.dmp
-
memory/4460-134-0x0000000002DA0000-0x0000000002DC2000-memory.dmpFilesize
136KB
-
memory/4460-131-0x0000000000DD0000-0x0000000000EDC000-memory.dmpFilesize
1.0MB
-
memory/4460-137-0x0000000002DA0000-0x0000000002DC2000-memory.dmpFilesize
136KB