Analysis
-
max time kernel
301s -
max time network
331s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
ScannedDocuments_0289716.lnk
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
ScannedDocuments_0289716.lnk
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
local.dll
Resource
win7-20220718-en
General
-
Target
ScannedDocuments_0289716.lnk
-
Size
1KB
-
MD5
f7581541da8f50b6e5c80d2ff42ee57b
-
SHA1
ea8d8e5b84fb388520e3ac422a222e39f6a21420
-
SHA256
8c1771c049cf36eecc7a37f207536a1a5fc2ca074c26e8c8c4e9dc167b8b3415
-
SHA512
ad87452fe5a2f808ebf2873cf8aa173a39fa1adc0d4294fbe8658a191177c0633cf55f07f7afc446f72073d412bc261611ae25150b01bab6487138a0ded084ba
Malware Config
Extracted
qakbot
403.688
obama187
1654695312
197.164.182.46:993
70.51.135.90:2222
187.251.132.144:22
37.186.54.254:995
80.11.74.81:2222
41.84.236.245:995
24.139.72.117:443
177.94.57.126:32101
37.34.253.233:443
186.90.153.162:2222
32.221.224.140:995
208.107.221.224:443
67.165.206.193:993
63.143.92.99:995
88.232.220.207:443
189.78.107.163:32101
74.14.5.179:2222
148.0.56.63:443
40.134.246.185:995
173.21.10.71:2222
124.40.244.115:2222
24.55.67.176:443
39.44.164.54:995
102.182.232.3:995
39.49.101.104:995
31.35.28.29:443
120.150.218.241:995
197.89.128.201:443
31.48.174.63:2078
173.174.216.62:443
67.209.195.198:443
70.46.220.114:443
24.178.196.158:2222
92.132.172.197:2222
179.158.105.44:443
1.161.123.53:443
91.177.173.10:995
217.128.122.65:2222
144.202.3.39:995
144.202.2.175:443
45.76.167.26:995
149.28.238.199:995
140.82.63.183:995
140.82.63.183:443
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
144.202.3.39:443
144.202.2.175:995
45.63.1.12:995
109.12.111.14:443
84.241.8.23:32103
104.34.212.7:32103
108.60.213.141:443
117.248.109.38:21
217.165.109.10:993
82.152.39.39:443
47.23.89.60:993
176.67.56.94:443
148.64.96.100:443
76.70.9.169:2222
182.191.92.203:995
37.210.170.123:2222
202.134.152.2:2222
89.101.97.139:443
86.195.158.178:2222
140.82.49.12:443
93.48.80.198:995
187.207.131.50:61202
191.34.120.8:443
37.208.135.172:6883
75.99.168.194:61201
5.32.41.45:443
120.61.1.225:443
101.51.77.238:443
1.161.123.53:995
86.97.9.190:443
175.145.235.37:443
39.44.235.10:995
196.203.37.215:80
41.38.167.179:995
39.41.17.134:995
58.105.167.36:50000
39.52.119.141:995
76.25.142.196:443
73.151.236.31:443
96.37.113.36:993
174.69.215.101:443
201.142.177.168:443
85.246.82.244:443
201.145.165.25:443
201.172.23.68:2222
72.252.157.93:995
190.252.242.69:443
45.46.53.140:2222
79.80.80.29:2222
72.252.157.93:990
72.27.33.160:443
72.252.157.93:993
90.120.65.153:2078
201.103.141.2:443
69.14.172.24:443
31.215.185.26:2222
191.112.12.128:443
189.253.206.105:443
82.41.63.217:443
208.101.82.0:443
210.246.4.69:995
83.110.92.106:443
180.129.108.214:995
47.157.227.70:443
89.86.33.217:443
177.156.191.231:443
94.36.193.176:2222
217.164.121.161:1194
86.98.149.168:2222
103.207.85.38:995
172.115.177.204:2222
105.27.172.6:443
71.24.118.253:443
143.0.219.6:995
217.165.176.49:2222
5.203.199.157:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
41.84.229.240:443
94.71.169.212:995
111.125.245.116:995
201.242.175.29:2222
38.70.253.226:2222
187.149.236.5:443
217.165.79.88:443
85.255.232.18:443
103.246.242.202:443
41.230.62.211:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Epmamjsdxuig = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Yabiqc = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2680 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 11 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\e8fe70dc = ef37153993c1e5e6da6a832ba4487e0831718bbd5c54535677d128515ca206a762b4f824d536b90a6c2a0efb13771cadfe76ad3d9528d52a01 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\97b71f2a = 2cf8581fc03861a84e4257b4fbe2065f20c7f24f8f68fd872da1b93ac22418b7f724a342eddac7d0d27917a9ded3e3bb8599b91e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\1a94a801 = 05486e0c1801d686bd97f0481f34b60e9a3f7aeb6279cfb1701ed1134237117477d809c2ca0237be13921b637010e096dea97e707129d61e2e45b35ad439ed86ffd6ced160c621530fc6a1c85f6c999d2da0532e84a31f739e4b5c2405c8b603b22fb9ea3d3ce8704af5cd54fe78fa explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\2d4a5833 = 6666753127bdeeced2ff22bc5a55158f5a2d008b2997facab4809e7c6fef5cb0136ac11eef46dd0e316f88df0bb72820420047e973d45f1130d56f560dc721936c4a3d6f1876ab1b6b8c133757fcd0134ea4c08bc1471e9f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\95f63f56 = 47cc5bb50afd3aebb9a03674a4ae7c84cd81887bbf2317c17149b6eaa8e7383e9eaa250f7fab26a6743843a7d86e47e38eb946e00bc81000063497353c8406c53b8f8cef8d0f3b23 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\65ddc7f7 = 51df5e53decb8dae6844e9b0051d6e1fb66578936c611db1e34c70b8f9d1d97eaedf627064dd6cec2c7076aa5179379bb8cdd5e36a73b4fc088af0605b8f7c40e3ef67ae3d65708a15200d1f1763963e29039ab6b2e522bcc459c21e055c5ce537f84e190b99b5fcd834134b3e7b7c5f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\1a94a801 = 05486e0c1801d686bd97f0481f34b60e9a3f7aeb6279cfb07810d8134237117477d809c2ca0237be13921b637010e096dea97e707129d61e2e45b35ad439ed86ffd6ced160c621530fc6a1c85f6c999d2da0532e84a31f739e4b5c2405c8b603b22fb9ea3d3ce8704af5cd54fe78fa explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\1a94a801 = 0548790c1801e352b8c3d969ad392c6eb471c7e9251d1ab18d9780ded1dae58b5d5cafa3793f55ecdfdc31aa424fc1e1a011ea3268a104ef917511de328b91891977de6a904834757dfc9e257f928261082c6242192e068280ca explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\2f0b784f = 0c01d530c3dd0f7cf39cd679869744a41f6c6a436be8ce29c9d2ec8067d8ef5709d73d85cda8ad86363ac857652636c82399ba8bc4a90d460ef45bd6fcfde643a4e890000e9dbba8e5570a062e8bb09f15a9d5de318e26e7d0f7ad29dd6fd44c607f031f6821ab2287d0b3a7e9dbb796608949d0f084325b34f79a198123f2ba061685e7bb71 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Elidenlpma\504217b9 = cab6ecdf0aac0265aec33e71efb0629ee9b735574fccc8bd5df784bb510c13457bbe971e5c365143e2dd2a752c42b2ff1795021b1bf7e1ca83d837c4675c198f926150a1bcea4c17c3f4a9ca79042dce87 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exepid process 2560 rundll32.exe 2560 rundll32.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2560 rundll32.exe 2680 regsvr32.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
cmd.exerundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 4812 wrote to memory of 1740 4812 cmd.exe rundll32.exe PID 4812 wrote to memory of 1740 4812 cmd.exe rundll32.exe PID 1740 wrote to memory of 2560 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2560 1740 rundll32.exe rundll32.exe PID 1740 wrote to memory of 2560 1740 rundll32.exe rundll32.exe PID 2560 wrote to memory of 4580 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 4580 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 4580 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 4580 2560 rundll32.exe explorer.exe PID 2560 wrote to memory of 4580 2560 rundll32.exe explorer.exe PID 4580 wrote to memory of 4044 4580 explorer.exe schtasks.exe PID 4580 wrote to memory of 4044 4580 explorer.exe schtasks.exe PID 4580 wrote to memory of 4044 4580 explorer.exe schtasks.exe PID 1576 wrote to memory of 2680 1576 regsvr32.exe regsvr32.exe PID 1576 wrote to memory of 2680 1576 regsvr32.exe regsvr32.exe PID 1576 wrote to memory of 2680 1576 regsvr32.exe regsvr32.exe PID 2680 wrote to memory of 2776 2680 regsvr32.exe explorer.exe PID 2680 wrote to memory of 2776 2680 regsvr32.exe explorer.exe PID 2680 wrote to memory of 2776 2680 regsvr32.exe explorer.exe PID 2680 wrote to memory of 2776 2680 regsvr32.exe explorer.exe PID 2680 wrote to memory of 2776 2680 regsvr32.exe explorer.exe PID 2776 wrote to memory of 3372 2776 explorer.exe reg.exe PID 2776 wrote to memory of 3372 2776 explorer.exe reg.exe PID 2776 wrote to memory of 2312 2776 explorer.exe reg.exe PID 2776 wrote to memory of 2312 2776 explorer.exe reg.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ScannedDocuments_0289716.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" local.dll,DllInstall2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" local.dll,DllInstall3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn hjommrxl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\local.dll\"" /SC ONCE /Z /ST 15:48 /ET 16:005⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\local.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\local.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Yabiqc" /d "0"4⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Epmamjsdxuig" /d "0"4⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD53bc34123feafc82ec82db6650b890763
SHA1df2755125d32051b9beb38de38a9a960d2ae7b31
SHA2561a1296b3063923647f59aedf3a12d8fccb700e4c5181c875b8622b7965cfb564
SHA512518a7b443222c7119d66187ce09fdd80b2fba547f7be73b6448c412d2536499181105b5641bed9f65b505e783454f0d8f691ece0ddc0ceac2c3f515220105152
-
C:\Users\Admin\AppData\Local\Temp\local.dllFilesize
843KB
MD53bc34123feafc82ec82db6650b890763
SHA1df2755125d32051b9beb38de38a9a960d2ae7b31
SHA2561a1296b3063923647f59aedf3a12d8fccb700e4c5181c875b8622b7965cfb564
SHA512518a7b443222c7119d66187ce09fdd80b2fba547f7be73b6448c412d2536499181105b5641bed9f65b505e783454f0d8f691ece0ddc0ceac2c3f515220105152
-
memory/1740-130-0x0000000000000000-mapping.dmp
-
memory/2312-150-0x0000000000000000-mapping.dmp
-
memory/2560-131-0x0000000000000000-mapping.dmp
-
memory/2560-132-0x0000000004270000-0x0000000004292000-memory.dmpFilesize
136KB
-
memory/2560-133-0x0000000004210000-0x0000000004242000-memory.dmpFilesize
200KB
-
memory/2560-134-0x0000000004270000-0x0000000004292000-memory.dmpFilesize
136KB
-
memory/2560-136-0x0000000004270000-0x0000000004292000-memory.dmpFilesize
136KB
-
memory/2680-145-0x0000000001E60000-0x0000000001E82000-memory.dmpFilesize
136KB
-
memory/2680-141-0x0000000000000000-mapping.dmp
-
memory/2680-143-0x0000000001E60000-0x0000000001E82000-memory.dmpFilesize
136KB
-
memory/2680-144-0x0000000001E00000-0x0000000001E32000-memory.dmpFilesize
200KB
-
memory/2680-147-0x0000000001E60000-0x0000000001E82000-memory.dmpFilesize
136KB
-
memory/2776-146-0x0000000000000000-mapping.dmp
-
memory/2776-148-0x0000000000110000-0x0000000000132000-memory.dmpFilesize
136KB
-
memory/2776-151-0x0000000000110000-0x0000000000132000-memory.dmpFilesize
136KB
-
memory/3372-149-0x0000000000000000-mapping.dmp
-
memory/4044-137-0x0000000000000000-mapping.dmp
-
memory/4580-139-0x0000000000F70000-0x0000000000F92000-memory.dmpFilesize
136KB
-
memory/4580-138-0x0000000000F70000-0x0000000000F92000-memory.dmpFilesize
136KB
-
memory/4580-135-0x0000000000000000-mapping.dmp