Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-09-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
newFor.db.dll
Resource
win7-20220812-en
General
-
Target
newFor.db.dll
-
Size
961KB
-
MD5
5f85b4cd792d6e3e2c11a7dba359a644
-
SHA1
a77eb84fe77aea8e7dc9d75167afb2f79282679e
-
SHA256
e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190
-
SHA512
1e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68
-
SSDEEP
12288:AkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJC:adhSlNKIybLKFBC1jNRZVdobrJLNMJx
Malware Config
Extracted
qakbot
403.862
BB
1663323048
200.161.62.126:32101
70.51.132.197:2222
78.100.228.93:995
78.100.225.34:2222
179.111.111.88:32101
102.38.97.72:995
217.165.68.125:993
193.3.19.37:443
70.49.33.200:2222
31.54.39.153:2078
99.232.140.205:2222
119.82.111.158:443
134.35.10.207:443
45.51.148.111:993
186.154.92.181:443
66.181.164.43:443
41.96.56.224:443
88.231.221.198:995
76.169.76.44:2222
68.53.110.74:995
196.64.237.138:443
190.44.40.48:995
72.88.245.71:443
197.94.210.133:443
87.243.113.104:995
84.38.133.191:443
14.184.97.67:443
123.240.131.1:443
194.166.207.160:995
176.90.193.145:2222
180.180.131.95:443
191.84.204.214:995
191.97.234.238:995
105.99.213.235:995
91.116.160.252:443
2.185.201.50:990
99.253.251.74:443
154.181.203.230:995
64.207.215.69:443
85.114.110.108:443
109.158.159.179:993
186.105.182.127:443
71.10.27.196:2222
41.69.118.117:995
47.146.182.110:443
197.204.143.46:443
194.49.79.231:443
88.242.228.16:53
88.231.221.198:443
175.110.231.67:443
196.92.172.24:8443
186.50.245.74:995
100.1.5.250:995
78.182.113.80:443
41.96.171.218:443
154.246.182.210:443
81.214.220.237:443
187.205.222.100:443
95.136.41.50:443
190.158.58.236:443
105.99.80.23:443
105.197.192.21:995
181.127.138.30:443
167.60.82.242:995
196.112.34.71:443
88.251.38.53:443
68.224.229.42:443
37.37.206.87:995
37.76.197.124:443
188.157.6.170:443
68.50.190.55:443
181.111.20.201:443
31.166.116.171:443
84.238.253.171:443
197.49.50.44:443
169.159.95.135:2222
45.160.124.211:995
113.22.102.155:443
211.248.176.4:443
186.167.249.206:443
85.98.206.165:995
139.195.132.210:2222
182.213.208.5:443
201.177.163.176:443
45.183.234.180:443
98.180.234.228:443
184.82.110.50:995
179.24.245.193:995
94.99.110.157:995
181.56.125.32:443
119.42.124.18:443
181.231.229.133:443
2.89.78.130:993
70.81.121.237:2222
181.81.116.144:443
197.11.128.156:443
41.142.132.190:443
105.111.60.60:995
154.238.151.197:995
156.219.49.22:995
179.223.89.154:995
102.101.231.141:443
220.116.250.45:443
138.0.114.166:443
62.114.193.186:995
85.98.46.114:443
184.99.123.118:443
186.120.58.88:443
46.186.216.41:32100
156.213.107.29:995
27.73.215.46:32102
68.151.196.147:995
68.129.232.158:443
45.241.140.181:995
212.156.51.194:443
87.75.195.211:443
1.10.253.207:443
87.220.229.164:2222
109.200.165.82:443
41.105.197.244:443
190.59.247.136:995
219.69.103.199:443
61.105.45.244:443
105.105.104.0:443
169.1.47.111:443
210.195.18.76:2222
118.175.247.124:995
88.246.170.2:443
149.140.193.233:443
171.248.157.128:995
118.68.220.199:443
139.195.63.45:2222
118.216.99.232:443
181.80.133.202:443
102.40.236.32:995
46.116.229.16:443
61.70.29.53:443
179.108.32.195:443
171.238.230.59:443
81.56.22.251:995
31.32.180.179:443
186.64.87.202:443
85.139.203.42:32101
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1944 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30d59544eac9d801 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exepowershell.exeregsvr32.exepid process 1436 rundll32.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 364 powershell.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1764 explorer.exe 1944 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1436 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 364 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exepowershell.exeregsvr32.exedescription pid process target process PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1436 1604 rundll32.exe rundll32.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1436 wrote to memory of 1764 1436 rundll32.exe explorer.exe PID 1764 wrote to memory of 1052 1764 explorer.exe schtasks.exe PID 1764 wrote to memory of 1052 1764 explorer.exe schtasks.exe PID 1764 wrote to memory of 1052 1764 explorer.exe schtasks.exe PID 1764 wrote to memory of 1052 1764 explorer.exe schtasks.exe PID 1932 wrote to memory of 364 1932 taskeng.exe powershell.exe PID 1932 wrote to memory of 364 1932 taskeng.exe powershell.exe PID 1932 wrote to memory of 364 1932 taskeng.exe powershell.exe PID 364 wrote to memory of 1876 364 powershell.exe regsvr32.exe PID 364 wrote to memory of 1876 364 powershell.exe regsvr32.exe PID 364 wrote to memory of 1876 364 powershell.exe regsvr32.exe PID 364 wrote to memory of 1876 364 powershell.exe regsvr32.exe PID 364 wrote to memory of 1876 364 powershell.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 1944 1876 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\newFor.db.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\newFor.db.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 16:35 /tn maxcnwdebz /ET 16:46 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbgBlAHcARgBvAHIALgBkAGIALgBkAGwAbAAiAA==" /SC ONCE4⤵
- Creates scheduled task(s)
PID:1052
-
C:\Windows\system32\taskeng.exetaskeng.exe {67A561F8-0A9F-4B32-AA58-A4D704C276B6} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbgBlAHcARgBvAHIALgBkAGIALgBkAGwAbAAiAA==2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\newFor.db.dll3⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\newFor.db.dll4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1944
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\newFor.db.dllFilesize
961KB
MD55f85b4cd792d6e3e2c11a7dba359a644
SHA1a77eb84fe77aea8e7dc9d75167afb2f79282679e
SHA256e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190
SHA5121e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68
-
\Users\Admin\AppData\Local\Temp\newFor.db.dllFilesize
961KB
MD55f85b4cd792d6e3e2c11a7dba359a644
SHA1a77eb84fe77aea8e7dc9d75167afb2f79282679e
SHA256e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190
SHA5121e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68
-
memory/364-71-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/364-72-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/364-79-0x00000000010EB000-0x000000000110A000-memory.dmpFilesize
124KB
-
memory/364-78-0x00000000010E4000-0x00000000010E7000-memory.dmpFilesize
12KB
-
memory/364-75-0x00000000010EB000-0x000000000110A000-memory.dmpFilesize
124KB
-
memory/364-74-0x00000000010E4000-0x00000000010E7000-memory.dmpFilesize
12KB
-
memory/364-73-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/364-70-0x0000000000000000-mapping.dmp
-
memory/1052-68-0x0000000000000000-mapping.dmp
-
memory/1436-56-0x00000000003F0000-0x00000000004E5000-memory.dmpFilesize
980KB
-
memory/1436-60-0x0000000000270000-0x0000000000296000-memory.dmpFilesize
152KB
-
memory/1436-66-0x00000000002B0000-0x00000000002D2000-memory.dmpFilesize
136KB
-
memory/1436-54-0x0000000000000000-mapping.dmp
-
memory/1436-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1436-57-0x00000000002D0000-0x00000000002F2000-memory.dmpFilesize
136KB
-
memory/1436-58-0x00000000002D0000-0x00000000002F2000-memory.dmpFilesize
136KB
-
memory/1436-59-0x00000000002D0000-0x00000000002F2000-memory.dmpFilesize
136KB
-
memory/1436-62-0x00000000002B0000-0x0000000000330000-memory.dmpFilesize
512KB
-
memory/1436-61-0x00000000002B0000-0x0000000000330000-memory.dmpFilesize
512KB
-
memory/1764-67-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1764-63-0x0000000000000000-mapping.dmp
-
memory/1764-65-0x00000000741C1000-0x00000000741C3000-memory.dmpFilesize
8KB
-
memory/1764-69-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1876-76-0x0000000000000000-mapping.dmp
-
memory/1944-88-0x0000000000980000-0x00000000009A2000-memory.dmpFilesize
136KB
-
memory/1944-81-0x0000000000000000-mapping.dmp
-
memory/1944-84-0x0000000000A00000-0x0000000000AF5000-memory.dmpFilesize
980KB
-
memory/1944-85-0x0000000000980000-0x00000000009A2000-memory.dmpFilesize
136KB
-
memory/1944-87-0x0000000000980000-0x00000000009A2000-memory.dmpFilesize
136KB
-
memory/1944-86-0x0000000000980000-0x00000000009A2000-memory.dmpFilesize
136KB