Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 16:50
Static task
static1
Behavioral task
behavioral1
Sample
twoOtherThen.dll
Resource
win7-20220414-en
General
-
Target
twoOtherThen.dll
-
Size
335KB
-
MD5
b34091299aae4ff301b3402179adc3cd
-
SHA1
4e7b94658ba637d4e05ee3fb60480aa4b934d7a0
-
SHA256
0d0f2885724cb94c9c1ca7c9bb436daca22f3934a4b10010dbaa3d3f51e7dc12
-
SHA512
bcdc6c19fb90d1b51eb8dfea3dea772051acf9e16eb3db9f742853f17b32b294217d9741555b5b1ed8e92dbf5531266fdbb5bcc72970aaa1b9bd6901d9720494
Malware Config
Extracted
qakbot
403.780
obama192
1655969261
100.38.242.113:995
94.59.252.166:2222
74.14.5.179:2222
71.13.93.154:2222
193.253.44.249:2222
108.60.213.141:443
45.241.231.78:993
217.128.122.65:2222
40.134.246.185:995
1.161.124.241:443
70.46.220.114:443
24.43.99.75:443
32.221.224.140:995
80.11.74.81:2222
31.215.184.140:2222
39.49.85.29:995
67.209.195.198:443
186.90.153.162:2222
148.64.96.100:443
67.165.206.193:993
210.246.4.69:995
208.107.221.224:443
89.101.97.139:443
78.176.146.141:443
121.7.223.45:2222
104.34.212.7:32103
69.14.172.24:443
41.228.22.180:443
197.87.182.60:443
24.178.196.158:2222
1.161.124.241:995
189.78.107.163:32101
38.70.253.226:2222
47.23.89.60:993
120.150.218.241:995
39.52.74.55:995
117.248.109.38:21
111.125.245.116:995
217.165.85.191:993
2.34.12.8:443
182.191.92.203:995
176.45.232.204:995
5.32.41.45:443
173.21.10.71:2222
39.41.2.45:995
90.114.10.16:2222
184.97.29.26:443
76.25.142.196:443
47.156.129.52:443
24.55.67.176:443
190.252.242.69:443
70.51.132.161:2222
72.252.157.93:995
90.120.209.197:2078
72.252.157.93:993
72.252.157.93:990
177.45.64.254:32101
24.139.72.117:443
187.250.202.2:443
94.36.193.176:2222
109.12.111.14:443
89.86.33.217:443
179.158.105.44:443
37.34.253.233:443
63.143.92.99:995
45.46.53.140:2222
31.215.67.68:2222
188.136.218.225:61202
187.208.115.219:443
31.215.184.140:1194
86.132.14.70:2078
39.57.60.246:995
24.122.142.181:443
84.241.8.23:32103
191.250.120.152:443
93.48.80.198:995
202.134.152.2:2222
91.177.173.10:995
148.0.43.48:443
172.115.177.204:2222
81.193.30.90:443
68.204.15.28:443
197.94.94.206:443
87.109.229.215:995
102.182.232.3:995
196.203.37.215:80
81.250.191.49:2222
83.110.94.105:443
201.176.6.24:995
173.174.216.62:443
31.215.70.37:443
175.145.235.37:443
174.69.215.101:443
187.172.164.12:443
201.172.23.68:2222
41.84.249.56:995
191.34.121.84:443
113.53.152.11:443
86.195.158.178:2222
109.228.220.196:443
82.41.63.217:443
82.152.39.39:443
106.51.48.188:50001
103.246.242.202:443
41.38.167.179:995
98.50.191.202:443
185.56.243.146:443
191.112.28.64:443
39.44.30.209:995
47.157.227.70:443
187.251.132.144:22
31.35.28.29:443
148.252.133.168:443
42.103.132.91:2222
180.129.108.214:995
138.186.28.253:443
89.137.52.44:443
120.61.2.218:443
122.118.129.227:995
124.109.35.171:995
75.99.168.194:61201
103.91.182.114:2222
37.210.156.247:2222
58.105.167.36:50000
187.207.131.50:61202
76.70.9.169:2222
187.211.80.39:443
176.67.56.94:443
103.116.178.85:995
143.0.219.6:995
79.80.80.29:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4736 regsvr32.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 51 IoCs
Processes:
powershell.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\c58293ee = bab3f382d739ee6787fc23805d9497afc7aff7065ad6b1fcd33a768c1f85be7d696bfbcb82b7f51e29e66cb63a4c983c6d06d2cfaa6268fdeeb3926286dfd434f8b188878ae8dccba2caab50899aa0cdd75ad30fa3536c explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\7d3ef48b = 93dbfeccae16f05a44a6bf8c498e80f98591f31ca249d853ba3f7a95e24319986c755c262af772037dc7da80ab738cd103bf25e2d5d93895035b7e7a895a87ab1e20d81e095568dab0bab0ece3e257fe3d029773c750cf explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\f25c63dc = 6c51e31880ee5d2e9edf13905a440225fe96a40ee4cb3ecafc6a01893716400026d4ba020c633b751d8c820a0cebead22d46dca7c022341b60b7926992cc325230c68ff9f2cdcaf6222209 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\7f7fd4f7 = 85bf49ff2ce8be5cb936cb52b72bf2bd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\f25c63dc = 6c51f41880ee6eac7d8e5b9fb57da7d01dd788ce03a423e4c4f5e21fd11896c174c184b3e4f5300dae5ecca6532919decf3191ab8ada24f2c4372b44fe99af2a6a5339bd4a97007359a71e4247a81e4190d1b60ff4c9d668af844840f4f0fe99 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\b88adc64 = 007572a209e84451a75268cbc054e848551b2655215f19d431073586ca99f2ce29a793504c68b704199fd824f2a59f94985d explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\36bb01 = 994d5aa35f4ea9c1760fd56adc185aea800d9b573ada62666f796aeefedc1eb1ae12694b002f9f3ff591ae9431813076cd1c709519f9ba84121b38bf9246528b62772a8b51b7d14c301e263fa6d385a8 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\8d150c2a = 48c4297b16107e67c31cb52d4c5201da6fae475f22 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fqlnteaorehl\c7c3b392 = a3171dca61ab10c6b1372d90daafef42c1ba7d5c4154e58fa6b2919783dd2af63b7c31bd9f56e4da04c02a3ad4c90b975205b29468b69c1ba54a893095c1dd3223a700d3dad32c6e2e65fa32b2a66710be16f431a2c8fbdb7a83ce453f9a90b63d9d5fa8de3ef8303098d3f31f7e04d2005aa369a2922163a70707fecb5d51a3d58205d9acd1e1dfe517197af5c8d830769381f9d690338acef843b6b1 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exeexplorer.exepid process 728 regsvr32.exe 728 regsvr32.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe 1476 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 728 regsvr32.exe 4736 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 616 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exedescription pid process target process PID 3588 wrote to memory of 728 3588 regsvr32.exe regsvr32.exe PID 3588 wrote to memory of 728 3588 regsvr32.exe regsvr32.exe PID 3588 wrote to memory of 728 3588 regsvr32.exe regsvr32.exe PID 728 wrote to memory of 1476 728 regsvr32.exe explorer.exe PID 728 wrote to memory of 1476 728 regsvr32.exe explorer.exe PID 728 wrote to memory of 1476 728 regsvr32.exe explorer.exe PID 728 wrote to memory of 1476 728 regsvr32.exe explorer.exe PID 728 wrote to memory of 1476 728 regsvr32.exe explorer.exe PID 1476 wrote to memory of 1828 1476 explorer.exe schtasks.exe PID 1476 wrote to memory of 1828 1476 explorer.exe schtasks.exe PID 1476 wrote to memory of 1828 1476 explorer.exe schtasks.exe PID 616 wrote to memory of 116 616 powershell.exe regsvr32.exe PID 616 wrote to memory of 116 616 powershell.exe regsvr32.exe PID 116 wrote to memory of 4736 116 regsvr32.exe regsvr32.exe PID 116 wrote to memory of 4736 116 regsvr32.exe regsvr32.exe PID 116 wrote to memory of 4736 116 regsvr32.exe regsvr32.exe PID 4736 wrote to memory of 1060 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1060 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1060 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1060 4736 regsvr32.exe explorer.exe PID 4736 wrote to memory of 1060 4736 regsvr32.exe explorer.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\twoOtherThen.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\twoOtherThen.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 18:52 /tn nctkgvhv /ET 19:03 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdAB3AG8ATwB0AGgAZQByAFQAaABlAG4ALgBkAGwAbAAiAA==" /SC ONCE4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdAB3AG8ATwB0AGgAZQByAFQAaABlAG4ALgBkAGwAbAAiAA==1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\twoOtherThen.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\twoOtherThen.dll3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\twoOtherThen.dllFilesize
335KB
MD5b34091299aae4ff301b3402179adc3cd
SHA14e7b94658ba637d4e05ee3fb60480aa4b934d7a0
SHA2560d0f2885724cb94c9c1ca7c9bb436daca22f3934a4b10010dbaa3d3f51e7dc12
SHA512bcdc6c19fb90d1b51eb8dfea3dea772051acf9e16eb3db9f742853f17b32b294217d9741555b5b1ed8e92dbf5531266fdbb5bcc72970aaa1b9bd6901d9720494
-
C:\Users\Admin\AppData\Local\Temp\twoOtherThen.dllFilesize
335KB
MD5b34091299aae4ff301b3402179adc3cd
SHA14e7b94658ba637d4e05ee3fb60480aa4b934d7a0
SHA2560d0f2885724cb94c9c1ca7c9bb436daca22f3934a4b10010dbaa3d3f51e7dc12
SHA512bcdc6c19fb90d1b51eb8dfea3dea772051acf9e16eb3db9f742853f17b32b294217d9741555b5b1ed8e92dbf5531266fdbb5bcc72970aaa1b9bd6901d9720494
-
memory/116-138-0x0000000000000000-mapping.dmp
-
memory/616-142-0x00007FFEB9A00000-0x00007FFEBA4C1000-memory.dmpFilesize
10.8MB
-
memory/616-143-0x00007FFEB9A00000-0x00007FFEBA4C1000-memory.dmpFilesize
10.8MB
-
memory/616-137-0x000001FF50030000-0x000001FF50052000-memory.dmpFilesize
136KB
-
memory/728-131-0x0000000001190000-0x00000000011B2000-memory.dmpFilesize
136KB
-
memory/728-130-0x0000000000000000-mapping.dmp
-
memory/728-133-0x0000000001190000-0x00000000011B2000-memory.dmpFilesize
136KB
-
memory/1060-145-0x0000000000000000-mapping.dmp
-
memory/1060-147-0x00000000014D0000-0x00000000014F2000-memory.dmpFilesize
136KB
-
memory/1060-148-0x00000000014D0000-0x00000000014F2000-memory.dmpFilesize
136KB
-
memory/1476-132-0x0000000000000000-mapping.dmp
-
memory/1476-135-0x00000000014D0000-0x00000000014F2000-memory.dmpFilesize
136KB
-
memory/1476-136-0x00000000014D0000-0x00000000014F2000-memory.dmpFilesize
136KB
-
memory/1828-134-0x0000000000000000-mapping.dmp
-
memory/4736-140-0x0000000000000000-mapping.dmp
-
memory/4736-144-0x00000000009D0000-0x00000000009F2000-memory.dmpFilesize
136KB
-
memory/4736-146-0x00000000009D0000-0x00000000009F2000-memory.dmpFilesize
136KB