Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
29-07-2022 23:13
Static task
static1
Behavioral task
behavioral1
Sample
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll
Resource
win7-20220715-en
General
-
Target
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll
-
Size
979KB
-
MD5
a54c368c81e44e3e30d39d20735eb2ae
-
SHA1
5381365f8afa1c9dff0da4fdb19a9527b6bf8118
-
SHA256
bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b
-
SHA512
abed3a88c56293a6377a87038b3811a07948ddbfbda9c58f21b6fddf4e39b89a059c9d98f764f154df7eba0497ed55907f34fd266bc2917a2cb916e4e49d2cd2
Malware Config
Extracted
qakbot
403.688
AA
1654852856
172.115.177.204:2222
78.177.60.224:443
75.99.168.194:61201
124.40.244.115:2222
32.221.224.140:995
31.35.28.29:443
186.90.153.162:2222
1.161.123.53:995
197.87.182.115:443
86.132.14.70:2078
197.94.94.206:443
74.14.5.179:2222
148.0.56.63:443
217.165.84.253:993
39.44.235.10:995
67.165.206.193:993
210.246.4.69:995
182.191.92.203:995
117.248.109.38:21
1.161.123.53:443
109.12.111.14:443
173.174.216.62:443
120.150.218.241:995
143.0.219.6:995
78.101.91.101:2222
104.34.212.7:32103
196.203.37.215:80
82.152.39.39:443
63.143.92.99:995
92.132.172.197:2222
91.177.173.10:995
217.128.122.65:2222
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
144.202.3.39:443
45.63.1.12:443
149.28.238.199:995
140.82.63.183:443
149.28.238.199:443
45.76.167.26:443
45.76.167.26:995
45.63.1.12:995
144.202.3.39:995
144.202.2.175:443
144.202.2.175:995
140.82.63.183:995
24.43.99.75:443
47.23.89.60:993
103.116.178.85:995
80.11.74.81:2222
41.84.246.251:995
108.60.213.141:443
76.70.9.169:2222
187.207.131.50:61202
58.105.167.36:50000
70.51.135.90:2222
176.67.56.94:443
93.48.80.198:995
148.64.96.100:443
140.82.49.12:443
208.107.221.224:443
39.49.7.196:995
39.44.154.111:995
189.146.87.77:443
176.205.23.48:1194
189.78.107.163:32101
39.52.38.254:995
173.21.10.71:2222
180.129.108.214:995
174.69.215.101:443
73.151.236.31:443
47.157.227.70:443
76.25.142.196:443
189.223.102.22:443
5.32.41.45:443
201.145.165.25:443
190.252.242.69:443
69.14.172.24:443
72.252.157.93:993
72.252.157.93:995
45.46.53.140:2222
72.252.157.93:990
89.101.97.139:443
201.1.202.82:32101
24.139.72.117:443
24.55.67.176:443
191.34.120.8:443
79.80.80.29:2222
179.158.105.44:443
187.251.132.144:22
191.112.4.17:443
101.108.199.194:443
43.248.68.197:2222
45.241.223.115:993
83.110.92.106:443
86.97.9.190:443
120.61.2.215:443
175.145.235.37:443
193.136.1.58:443
39.41.106.95:995
37.186.54.96:995
86.195.158.178:2222
201.172.23.68:2222
40.134.246.185:995
90.120.209.197:2078
96.37.113.36:993
102.182.232.3:995
37.34.253.233:443
94.36.193.176:2222
176.205.23.48:2222
37.208.135.172:6883
84.241.8.23:32103
41.38.167.179:995
72.27.33.160:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
89.86.33.217:443
189.37.80.240:443
86.98.149.168:2222
103.207.85.38:995
71.24.118.253:443
217.165.176.49:2222
109.178.178.110:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.255:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exepid process 736 rundll32.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe 1936 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 736 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exedescription pid process target process PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 288 wrote to memory of 736 288 rundll32.exe rundll32.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 736 wrote to memory of 1936 736 rundll32.exe explorer.exe PID 1936 wrote to memory of 1892 1936 explorer.exe schtasks.exe PID 1936 wrote to memory of 1892 1936 explorer.exe schtasks.exe PID 1936 wrote to memory of 1892 1936 explorer.exe schtasks.exe PID 1936 wrote to memory of 1892 1936 explorer.exe schtasks.exe PID 1704 wrote to memory of 1152 1704 taskeng.exe regsvr32.exe PID 1704 wrote to memory of 1152 1704 taskeng.exe regsvr32.exe PID 1704 wrote to memory of 1152 1704 taskeng.exe regsvr32.exe PID 1704 wrote to memory of 1152 1704 taskeng.exe regsvr32.exe PID 1704 wrote to memory of 1152 1704 taskeng.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 1564 1152 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn godufotxl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll\"" /SC ONCE /Z /ST 23:16 /ET 23:284⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {81C0EBD1-B583-4A8F-9F87-D3B1E1CFD0EB} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dllFilesize
979KB
MD5a54c368c81e44e3e30d39d20735eb2ae
SHA15381365f8afa1c9dff0da4fdb19a9527b6bf8118
SHA256bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b
SHA512abed3a88c56293a6377a87038b3811a07948ddbfbda9c58f21b6fddf4e39b89a059c9d98f764f154df7eba0497ed55907f34fd266bc2917a2cb916e4e49d2cd2
-
memory/736-57-0x00000000022B0000-0x00000000022D2000-memory.dmpFilesize
136KB
-
memory/736-56-0x00000000007B0000-0x00000000008A7000-memory.dmpFilesize
988KB
-
memory/736-59-0x00000000022B0000-0x00000000022D2000-memory.dmpFilesize
136KB
-
memory/736-58-0x00000000022B0000-0x00000000022D2000-memory.dmpFilesize
136KB
-
memory/736-60-0x0000000002270000-0x00000000022A2000-memory.dmpFilesize
200KB
-
memory/736-61-0x00000000022B0000-0x00000000022D2000-memory.dmpFilesize
136KB
-
memory/736-55-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/736-65-0x00000000022B0000-0x00000000022D2000-memory.dmpFilesize
136KB
-
memory/736-54-0x0000000000000000-mapping.dmp
-
memory/1152-69-0x0000000000000000-mapping.dmp
-
memory/1152-70-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/1564-72-0x0000000000000000-mapping.dmp
-
memory/1892-67-0x0000000000000000-mapping.dmp
-
memory/1936-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1936-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1936-64-0x0000000074411000-0x0000000074413000-memory.dmpFilesize
8KB
-
memory/1936-62-0x0000000000000000-mapping.dmp