Analysis
-
max time kernel
299s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
11-08-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
ScannedDocuments_0289716.lnk
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
ScannedDocuments_0289716.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
local.dll
Resource
win7-20220718-en
General
-
Target
ScannedDocuments_0289716.lnk
-
Size
1KB
-
MD5
f7581541da8f50b6e5c80d2ff42ee57b
-
SHA1
ea8d8e5b84fb388520e3ac422a222e39f6a21420
-
SHA256
8c1771c049cf36eecc7a37f207536a1a5fc2ca074c26e8c8c4e9dc167b8b3415
-
SHA512
ad87452fe5a2f808ebf2873cf8aa173a39fa1adc0d4294fbe8658a191177c0633cf55f07f7afc446f72073d412bc261611ae25150b01bab6487138a0ded084ba
Malware Config
Extracted
qakbot
403.688
obama187
1654695312
197.164.182.46:993
70.51.135.90:2222
187.251.132.144:22
37.186.54.254:995
80.11.74.81:2222
41.84.236.245:995
24.139.72.117:443
177.94.57.126:32101
37.34.253.233:443
186.90.153.162:2222
32.221.224.140:995
208.107.221.224:443
67.165.206.193:993
63.143.92.99:995
88.232.220.207:443
189.78.107.163:32101
74.14.5.179:2222
148.0.56.63:443
40.134.246.185:995
173.21.10.71:2222
124.40.244.115:2222
24.55.67.176:443
39.44.164.54:995
102.182.232.3:995
39.49.101.104:995
31.35.28.29:443
120.150.218.241:995
197.89.128.201:443
31.48.174.63:2078
173.174.216.62:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
92.132.172.197:2222
179.158.105.44:443
1.161.123.53:443
91.177.173.10:995
217.128.122.65:2222
144.202.3.39:995
144.202.2.175:443
45.76.167.26:995
149.28.238.199:995
140.82.63.183:995
140.82.63.183:443
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
144.202.3.39:443
144.202.2.175:995
45.63.1.12:995
109.12.111.14:443
84.241.8.23:32103
104.34.212.7:32103
108.60.213.141:443
117.248.109.38:21
217.165.109.10:993
82.152.39.39:443
47.23.89.60:993
176.67.56.94:443
148.64.96.100:443
76.70.9.169:2222
182.191.92.203:995
37.210.170.123:2222
202.134.152.2:2222
89.101.97.139:443
86.195.158.178:2222
140.82.49.12:443
93.48.80.198:995
187.207.131.50:61202
191.34.120.8:443
37.208.135.172:6883
75.99.168.194:61201
5.32.41.45:443
120.61.1.225:443
101.51.77.238:443
1.161.123.53:995
86.97.9.190:443
175.145.235.37:443
39.44.235.10:995
196.203.37.215:80
41.38.167.179:995
39.41.17.134:995
58.105.167.36:50000
39.52.119.141:995
76.25.142.196:443
73.151.236.31:443
96.37.113.36:993
174.69.215.101:443
201.142.177.168:443
85.246.82.244:443
201.145.165.25:443
201.172.23.68:2222
72.252.157.93:995
190.252.242.69:443
45.46.53.140:2222
79.80.80.29:2222
72.252.157.93:990
72.27.33.160:443
72.252.157.93:993
90.120.65.153:2078
201.103.141.2:443
69.14.172.24:443
31.215.185.26:2222
191.112.12.128:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
210.246.4.69:995
83.110.92.106:443
180.129.108.214:995
47.157.227.70:443
89.86.33.217:443
177.156.191.231:443
94.36.193.176:2222
217.164.121.161:1194
86.98.149.168:2222
103.207.85.38:995
172.115.177.204:2222
105.27.172.6:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
5.203.199.157:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Yeekeuuz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Vndvphyysy = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 936 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fcijics explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\193206fe = 7fa48a3dc858eb14630faadd165b34ccd3ba50357188baf88e6f2ae6ff939ea9f43b89833435db936368b3158fde413854e6e3c1b3043a12d72c1ae01b32d129f500b442f21598824abb67f70d53e67f31cf07d976699b8c6ab8dc48d6f5d87da6ad96243ee215a6 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\1b732682 = fc2b6c36b80e3b4e0bca6426f87c3165786f35b94ae734adb3d6fab6feee60813da2eba9fd5ea8f2b11aa14b6614ad327d3f5f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\dec70e6d = bc60c4718ff6a37617578cc67f7d5f417baf13f9afed2e937ceb0e06ac2e2ef6540bd81dcbd2aafe4f593b68 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\53e4b946 = c6a9b7e3d4f2f2ccfcf3cc1cc5ddea53ada041c2a7d6e08ef36b8988a7baa358409b68c077446c21480a1743f29c1d5b0332800405715f2a8e5f5d3ce42bcfdcc694c70057ceb3b8b19bf13d45e0f87de251f7c592ff0d98fb54f1b7156485dc14f89d43144003bb1d15914e37c441 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\2cadd6b0 = eb7fcfd19693eee02a9a0b33adb6125472a796829f9f9a1ad40f5e31ec33f1d14ed737a0f12b158e641c3be7ab3ae68e8bfb02c031b261283384c7914159b09eb39ae0dc650ac047968a4c68bbfa9297be018ede6dba explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\2cadd6b0 = eb7fd8d19693db0da332d76a8bbdcd590a46d06fb960c69466d914bf7d355abd4af91fef5935f2ab507db5270f16038d02e3fcd02e0e3dc6982a0df386419985f0 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\a3cf41e7 = 7ea1870b026410ba561a2bddbe68ddabe17b82abde0fabdd02af69597bf326b5abc5a11ac9507fbf7303d0a7f0a79b6e6b0c3c0ddfd9ce explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\667b6908 = 3d8ef6a3fa2daa8daa1189ef96dd9030cd6fc31ef4d64d76231cae43930076448085f53b6aa49db6e7d52be6d06c467ae222e343c6c65e2c07bd114b2d0bf48abccad6c874df56416ac1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Fcijics\a18e619b = d4c4e8a8d113f5a7376c00a1d66b4fb87ca16955a2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exeregsvr32.exepid process 1112 rundll32.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 936 regsvr32.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1112 rundll32.exe 936 regsvr32.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
cmd.exerundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1972 wrote to memory of 1720 1972 cmd.exe rundll32.exe PID 1972 wrote to memory of 1720 1972 cmd.exe rundll32.exe PID 1972 wrote to memory of 1720 1972 cmd.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 1112 1720 rundll32.exe rundll32.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1112 wrote to memory of 1816 1112 rundll32.exe explorer.exe PID 1816 wrote to memory of 1864 1816 explorer.exe schtasks.exe PID 1816 wrote to memory of 1864 1816 explorer.exe schtasks.exe PID 1816 wrote to memory of 1864 1816 explorer.exe schtasks.exe PID 1816 wrote to memory of 1864 1816 explorer.exe schtasks.exe PID 2012 wrote to memory of 1944 2012 taskeng.exe regsvr32.exe PID 2012 wrote to memory of 1944 2012 taskeng.exe regsvr32.exe PID 2012 wrote to memory of 1944 2012 taskeng.exe regsvr32.exe PID 2012 wrote to memory of 1944 2012 taskeng.exe regsvr32.exe PID 2012 wrote to memory of 1944 2012 taskeng.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 936 1944 regsvr32.exe regsvr32.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 936 wrote to memory of 1344 936 regsvr32.exe explorer.exe PID 1344 wrote to memory of 1468 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1468 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1468 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1468 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1764 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1764 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1764 1344 explorer.exe reg.exe PID 1344 wrote to memory of 1764 1344 explorer.exe reg.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ScannedDocuments_0289716.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" local.dll,DllInstall2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" local.dll,DllInstall3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wviyvcin /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\local.dll\"" /SC ONCE /Z /ST 15:48 /ET 16:005⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {D97A349E-48FF-4196-9737-3B14C6DE9D7E} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\local.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\local.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yeekeuuz" /d "0"5⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Vndvphyysy" /d "0"5⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD53bc34123feafc82ec82db6650b890763
SHA1df2755125d32051b9beb38de38a9a960d2ae7b31
SHA2561a1296b3063923647f59aedf3a12d8fccb700e4c5181c875b8622b7965cfb564
SHA512518a7b443222c7119d66187ce09fdd80b2fba547f7be73b6448c412d2536499181105b5641bed9f65b505e783454f0d8f691ece0ddc0ceac2c3f515220105152
-
\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD53bc34123feafc82ec82db6650b890763
SHA1df2755125d32051b9beb38de38a9a960d2ae7b31
SHA2561a1296b3063923647f59aedf3a12d8fccb700e4c5181c875b8622b7965cfb564
SHA512518a7b443222c7119d66187ce09fdd80b2fba547f7be73b6448c412d2536499181105b5641bed9f65b505e783454f0d8f691ece0ddc0ceac2c3f515220105152
-
memory/936-124-0x0000000000340000-0x0000000000362000-memory.dmpFilesize
136KB
-
memory/936-119-0x0000000000340000-0x0000000000362000-memory.dmpFilesize
136KB
-
memory/936-118-0x00000000002C0000-0x00000000002F2000-memory.dmpFilesize
200KB
-
memory/936-116-0x0000000000340000-0x0000000000362000-memory.dmpFilesize
136KB
-
memory/936-117-0x0000000000340000-0x0000000000362000-memory.dmpFilesize
136KB
-
memory/936-115-0x0000000000340000-0x0000000000362000-memory.dmpFilesize
136KB
-
memory/936-114-0x0000000000B00000-0x0000000000BD7000-memory.dmpFilesize
860KB
-
memory/936-111-0x0000000000000000-mapping.dmp
-
memory/1112-99-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1112-97-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1112-104-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1112-89-0x0000000000000000-mapping.dmp
-
memory/1112-93-0x0000000075C01000-0x0000000075C03000-memory.dmpFilesize
8KB
-
memory/1112-94-0x00000000008B0000-0x0000000000987000-memory.dmpFilesize
860KB
-
memory/1112-95-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1112-96-0x0000000000300000-0x0000000000332000-memory.dmpFilesize
200KB
-
memory/1112-100-0x0000000000350000-0x0000000000372000-memory.dmpFilesize
136KB
-
memory/1344-120-0x0000000000000000-mapping.dmp
-
memory/1344-123-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1344-127-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1468-125-0x0000000000000000-mapping.dmp
-
memory/1720-88-0x0000000000000000-mapping.dmp
-
memory/1764-126-0x0000000000000000-mapping.dmp
-
memory/1816-101-0x0000000000000000-mapping.dmp
-
memory/1816-107-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1816-105-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1816-103-0x0000000074331000-0x0000000074333000-memory.dmpFilesize
8KB
-
memory/1864-106-0x0000000000000000-mapping.dmp
-
memory/1944-108-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmpFilesize
8KB