Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
15-07-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
main.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
main.dll
Resource
win10v2004-20220414-en
General
-
Target
main.dll
-
Size
777KB
-
MD5
926382093a313282f4a1639944f3fb0c
-
SHA1
851380d94deeb031aad806795d760f3982399850
-
SHA256
1ce7c87d8dc79ace14eb2a1be829f2d3b321b70717f723a61998ab3b9112eec8
-
SHA512
f315d01e8475c4bc73a9c2e18c17c462b826dec66d9900534f0ccddd08f782642828fe1c2b3a04049f82c38f24cd48f419c7d1c91200ca1de32f27642ac145d3
Malware Config
Extracted
qakbot
403.780
vip01
1657631718
47.23.89.60:993
37.34.253.233:443
196.203.37.215:80
89.211.209.234:2222
81.158.239.251:2078
179.111.8.52:32101
208.107.221.224:443
24.158.23.166:995
66.230.104.103:443
92.132.132.81:2222
24.139.72.117:443
174.80.15.101:2083
24.178.196.158:2222
100.38.242.113:995
37.186.58.99:995
24.55.67.176:443
74.14.5.179:2222
172.114.160.81:443
40.134.246.185:995
63.143.92.99:995
67.209.195.198:443
179.158.105.44:443
148.64.96.100:443
111.125.245.116:995
32.221.224.140:995
117.248.109.38:21
84.241.8.23:32103
47.180.172.159:443
70.46.220.114:443
109.12.111.14:443
176.45.218.138:995
89.101.97.139:443
121.7.223.45:2222
24.54.48.11:443
94.59.15.180:2222
120.150.218.241:995
187.116.126.216:32101
186.90.153.162:2222
38.70.253.226:2222
104.34.212.7:32103
41.228.22.180:443
217.165.157.202:995
67.165.206.193:993
86.98.78.118:993
172.115.177.204:2222
1.161.79.116:443
82.41.63.217:443
85.6.232.221:2222
93.48.80.198:995
1.161.79.116:995
86.97.10.37:443
174.69.215.101:443
45.46.53.140:2222
197.87.182.135:443
197.94.219.121:443
96.37.113.36:993
76.25.142.196:443
173.21.10.71:2222
217.128.122.65:2222
47.145.130.171:443
47.156.129.52:443
187.172.164.12:443
72.252.157.93:990
72.252.157.93:993
190.252.242.69:443
72.252.157.93:995
69.14.172.24:443
2.178.120.112:61202
70.51.137.244:2222
94.36.193.176:2222
81.193.30.90:443
103.133.11.10:995
120.61.3.142:443
182.52.159.24:443
201.172.23.72:2222
37.208.131.49:50010
173.174.216.62:443
103.246.242.202:443
106.51.48.188:50001
182.191.92.203:995
86.97.246.166:1194
67.69.166.79:2222
45.241.254.69:993
39.49.41.221:995
88.240.59.52:443
39.44.60.200:995
39.52.59.221:995
39.41.16.210:995
217.164.119.30:2222
86.213.75.30:2078
39.57.56.11:995
24.43.99.75:443
101.50.67.155:995
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
184.97.29.26:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 968 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a0dafe8bb498d801 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exepowershell.exepid process 2008 rundll32.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 888 powershell.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe 1900 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 2008 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 888 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exedescription pid process target process PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 644 wrote to memory of 2008 644 rundll32.exe rundll32.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 2008 wrote to memory of 1900 2008 rundll32.exe explorer.exe PID 1900 wrote to memory of 1252 1900 explorer.exe schtasks.exe PID 1900 wrote to memory of 1252 1900 explorer.exe schtasks.exe PID 1900 wrote to memory of 1252 1900 explorer.exe schtasks.exe PID 1900 wrote to memory of 1252 1900 explorer.exe schtasks.exe PID 1068 wrote to memory of 888 1068 taskeng.exe powershell.exe PID 1068 wrote to memory of 888 1068 taskeng.exe powershell.exe PID 1068 wrote to memory of 888 1068 taskeng.exe powershell.exe PID 888 wrote to memory of 1684 888 powershell.exe regsvr32.exe PID 888 wrote to memory of 1684 888 powershell.exe regsvr32.exe PID 888 wrote to memory of 1684 888 powershell.exe regsvr32.exe PID 888 wrote to memory of 1684 888 powershell.exe regsvr32.exe PID 888 wrote to memory of 1684 888 powershell.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe PID 1684 wrote to memory of 968 1684 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\main.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\main.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 01:37 /tn fccoyfpmge /ET 01:48 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBhAGkAbgAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {730F76EE-A3C6-4D19-AD2E-77B54A1C454F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbQBhAGkAbgAuAGQAbABsACIA2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\main.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\main.dll4⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\main.dllFilesize
777KB
MD5926382093a313282f4a1639944f3fb0c
SHA1851380d94deeb031aad806795d760f3982399850
SHA2561ce7c87d8dc79ace14eb2a1be829f2d3b321b70717f723a61998ab3b9112eec8
SHA512f315d01e8475c4bc73a9c2e18c17c462b826dec66d9900534f0ccddd08f782642828fe1c2b3a04049f82c38f24cd48f419c7d1c91200ca1de32f27642ac145d3
-
\Users\Admin\AppData\Local\Temp\main.dllFilesize
777KB
MD5926382093a313282f4a1639944f3fb0c
SHA1851380d94deeb031aad806795d760f3982399850
SHA2561ce7c87d8dc79ace14eb2a1be829f2d3b321b70717f723a61998ab3b9112eec8
SHA512f315d01e8475c4bc73a9c2e18c17c462b826dec66d9900534f0ccddd08f782642828fe1c2b3a04049f82c38f24cd48f419c7d1c91200ca1de32f27642ac145d3
-
memory/888-69-0x0000000000000000-mapping.dmp
-
memory/888-78-0x00000000011EB000-0x000000000120A000-memory.dmpFilesize
124KB
-
memory/888-77-0x00000000011E4000-0x00000000011E7000-memory.dmpFilesize
12KB
-
memory/888-74-0x00000000011EB000-0x000000000120A000-memory.dmpFilesize
124KB
-
memory/888-73-0x00000000011E4000-0x00000000011E7000-memory.dmpFilesize
12KB
-
memory/888-72-0x000007FEF4050000-0x000007FEF4BAD000-memory.dmpFilesize
11.4MB
-
memory/888-71-0x000007FEF4BB0000-0x000007FEF55D3000-memory.dmpFilesize
10.1MB
-
memory/888-70-0x000007FEFC521000-0x000007FEFC523000-memory.dmpFilesize
8KB
-
memory/968-80-0x0000000000000000-mapping.dmp
-
memory/968-88-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/968-87-0x00000000002C0000-0x00000000002E2000-memory.dmpFilesize
136KB
-
memory/968-86-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/968-85-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/968-84-0x00000000002F0000-0x0000000000312000-memory.dmpFilesize
136KB
-
memory/968-83-0x00000000009C0000-0x0000000000A86000-memory.dmpFilesize
792KB
-
memory/1252-67-0x0000000000000000-mapping.dmp
-
memory/1684-75-0x0000000000000000-mapping.dmp
-
memory/1900-62-0x0000000000000000-mapping.dmp
-
memory/1900-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1900-64-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1900-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/2008-59-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/2008-58-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/2008-57-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/2008-56-0x0000000000250000-0x0000000000316000-memory.dmpFilesize
792KB
-
memory/2008-54-0x0000000000000000-mapping.dmp
-
memory/2008-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/2008-60-0x00000000001D0000-0x00000000001F2000-memory.dmpFilesize
136KB
-
memory/2008-61-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB
-
memory/2008-65-0x00000000003C0000-0x00000000003E2000-memory.dmpFilesize
136KB