Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
28-07-2022 15:01
General
-
Target
c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll
-
Size
543KB
-
MD5
ffaf9cd085434fd5230511ab895ba494
-
SHA1
9e49d29d66d380255e5e8e2ccf19f5b51eb92001
-
SHA256
c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a
-
SHA512
01890758e839b3eb90dc3711dd470ba1e232798ed0f62d89185e450877161fd321b5b125ab0a64f270c2f37ef129f59eb5848164d26fb4965534d77a0d4f2300
Malware Config
Extracted
qakbot
403.573
AA
1649660679
41.228.22.180:443
47.23.89.62:995
176.67.56.94:443
103.107.113.120:443
148.64.96.100:443
47.180.172.159:443
181.118.183.98:443
140.82.49.12:443
103.87.95.133:2222
96.21.251.127:2222
197.167.62.14:993
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
80.11.74.81:2222
66.98.42.102:443
75.99.168.194:61201
173.174.216.62:443
45.9.20.200:443
39.41.158.185:995
187.207.48.194:61202
41.84.237.10:995
93.48.80.198:995
105.226.83.196:995
144.202.2.175:443
45.76.167.26:995
144.202.3.39:443
144.202.3.39:995
140.82.63.183:443
45.63.1.12:995
140.82.63.183:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
149.28.238.199:995
47.180.172.159:50010
71.13.93.154:2222
86.98.33.141:443
31.35.28.29:443
113.11.89.165:995
175.145.235.37:443
117.248.109.38:21
94.59.138.62:2222
32.221.224.140:995
5.95.58.211:2087
81.215.196.174:443
176.88.238.122:995
94.59.138.62:1194
92.132.172.197:2222
70.46.220.114:443
78.87.206.213:995
197.89.108.252:443
39.44.144.159:995
176.205.119.81:2078
91.177.173.10:995
72.76.94.99:443
24.178.196.158:2222
1.161.71.109:995
172.114.160.81:995
173.21.10.71:2222
1.161.71.109:443
86.97.11.43:443
217.128.122.65:2222
86.98.33.141:995
203.122.46.130:443
89.211.181.64:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.97:2222
202.134.152.2:2222
120.150.218.241:995
45.46.53.140:2222
180.129.102.214:995
217.164.210.192:443
217.165.147.83:993
84.241.8.23:32103
180.183.128.80:2222
74.15.2.252:2222
76.70.9.169:2222
47.23.89.62:993
75.113.214.234:2222
208.107.221.224:443
76.169.147.192:32103
190.73.3.148:2222
76.69.155.202:2222
96.29.208.97:443
108.60.213.141:443
75.99.168.194:443
182.191.92.203:995
73.151.236.31:443
38.70.253.226:2222
39.52.75.201:995
121.74.167.191:995
201.211.64.196:2222
71.74.12.34:443
191.99.191.28:443
85.246.82.244:443
101.50.103.193:995
182.253.189.74:2222
67.209.195.198:443
90.120.65.153:2078
37.34.253.233:443
96.37.113.36:993
181.62.0.59:443
41.38.167.179:995
197.205.127.234:443
45.241.232.25:995
185.69.144.209:443
2.50.137.197:443
73.67.152.98:2222
76.25.142.196:443
125.168.47.127:2222
201.145.189.252:443
109.12.111.14:443
102.182.232.3:995
72.12.115.90:22
47.156.191.217:443
174.69.215.101:443
70.51.138.126:2222
186.105.121.166:443
179.158.105.44:443
94.36.195.250:2222
109.228.220.196:443
120.61.2.95:443
103.88.226.30:443
103.139.243.207:990
68.204.7.158:443
196.233.79.3:80
39.57.76.82:995
187.250.114.15:443
103.246.242.202:443
190.252.242.69:443
5.32.41.45:443
100.1.108.246:443
72.252.201.34:995
191.17.223.93:32101
40.134.246.185:995
187.102.135.142:2222
191.34.199.129:443
181.208.248.227:443
138.204.24.70:443
209.197.176.40:995
42.235.146.7:2222
82.152.39.39:443
41.230.62.211:993
31.48.166.122:2078
187.251.132.144:22
143.0.34.185:443
88.228.250.126:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
regsvr32.exeexplorer.exepid process 2996 regsvr32.exe 2996 regsvr32.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe 1172 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 2996 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
regsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3868 wrote to memory of 2996 3868 regsvr32.exe regsvr32.exe PID 3868 wrote to memory of 2996 3868 regsvr32.exe regsvr32.exe PID 3868 wrote to memory of 2996 3868 regsvr32.exe regsvr32.exe PID 2996 wrote to memory of 1172 2996 regsvr32.exe explorer.exe PID 2996 wrote to memory of 1172 2996 regsvr32.exe explorer.exe PID 2996 wrote to memory of 1172 2996 regsvr32.exe explorer.exe PID 2996 wrote to memory of 1172 2996 regsvr32.exe explorer.exe PID 2996 wrote to memory of 1172 2996 regsvr32.exe explorer.exe PID 1172 wrote to memory of 1300 1172 explorer.exe schtasks.exe PID 1172 wrote to memory of 1300 1172 explorer.exe schtasks.exe PID 1172 wrote to memory of 1300 1172 explorer.exe schtasks.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn idwtofmxb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll\"" /SC ONCE /Z /ST 17:04 /ET 17:164⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-177-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-178-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-169-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-170-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-171-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-255-0x0000000002870000-0x00000000028FF000-memory.dmpFilesize
572KB
-
memory/1172-168-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-179-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-172-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-167-0x0000000000000000-mapping.dmp
-
memory/1172-176-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-175-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-174-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1172-173-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/1300-232-0x0000000000000000-mapping.dmp
-
memory/2996-145-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-143-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-127-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-128-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-129-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-130-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-131-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-125-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-133-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-134-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-135-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-136-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-137-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-138-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-139-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-140-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-141-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-142-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-144-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-122-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-147-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-148-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-150-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-152-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-151-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-149-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-146-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-126-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-132-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-153-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-154-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-155-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-156-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-157-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-158-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-159-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-160-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-161-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-124-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-123-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-121-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-120-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-119-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-118-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-117-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-116-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-115-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-114-0x0000000000000000-mapping.dmp
-
memory/2996-162-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-163-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-164-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-165-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/2996-166-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB