Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
17-10-2022 14:25
Static task
static1
Behavioral task
behavioral1
Sample
qakbot_loader.dll
Resource
win7-20220901-en
General
-
Target
qakbot_loader.dll
-
Size
1.0MB
-
MD5
433893e5a6e12aed9ec0400812690147
-
SHA1
4b4ca66c1818d2e5ff9f4ea2afb136af2bd96564
-
SHA256
9c3d3cd9b0fcb39117692600a7296b68dddf2995c6d302bc9d9c8b786780ba19
-
SHA512
3782c98a4ee96566b19577e586177f0d637e44c55a9072113035980cbbe02e524f9c7c6c8e5d06ee05a6e3f0875c6f8800ac120f02dd596c2d8f43ca9c7da435
-
SSDEEP
12288:PhelIk3mnXCDHlvxIDmgiSbqtAghJwznk9x5n52oyPzm0PosefMyvgulSMyvguln:8KkMilvxqm2G2W92/zJPXy5Hy579
Malware Config
Extracted
qakbot
403.688
obama189
1655107308
91.177.173.10:995
117.248.109.38:21
182.191.92.203:995
39.52.38.164:995
217.165.84.253:993
84.241.8.23:32103
82.152.39.39:443
202.134.152.2:2222
122.118.131.132:995
120.150.218.241:995
222.169.71.98:2222
37.34.253.233:443
93.48.80.198:995
148.0.55.173:443
175.145.235.37:443
41.130.140.32:993
120.61.0.71:443
89.101.97.139:443
62.204.41.187:443
62.204.41.187:2222
62.204.41.187:61201
67.209.195.198:443
80.11.74.81:2222
92.132.172.197:2222
41.84.249.88:995
39.41.116.234:995
67.165.206.193:993
173.21.10.71:2222
148.64.96.100:443
172.115.177.204:2222
186.90.153.162:2222
32.221.224.140:995
108.60.213.141:443
63.143.92.99:995
24.43.99.75:443
174.69.215.101:443
85.101.222.204:443
76.25.142.196:443
39.44.146.220:995
5.32.41.45:443
1.161.123.53:995
74.14.5.179:2222
62.204.41.187:995
24.178.196.158:2222
83.110.92.106:443
86.97.9.190:443
41.228.22.180:443
38.70.253.226:2222
47.23.89.60:993
45.46.53.140:2222
82.41.63.217:443
173.174.216.62:443
189.223.102.22:443
69.14.172.24:443
102.182.232.3:995
86.97.247.161:1194
94.36.193.176:2222
200.100.126.210:32101
114.137.226.124:443
104.34.212.7:32103
41.38.167.179:995
37.210.156.247:2222
86.195.158.178:2222
187.149.236.5:443
201.172.23.68:2222
70.51.135.90:2222
77.200.155.99:443
191.112.21.157:443
179.158.105.44:443
125.24.187.231:443
180.129.108.214:995
39.44.235.10:995
109.228.220.196:443
39.49.82.115:995
58.105.167.36:50000
190.252.242.69:443
197.94.94.206:443
62.204.41.187:990
191.34.120.8:443
72.252.157.93:993
201.1.202.82:32101
187.207.131.50:61202
76.70.9.169:2222
62.204.41.187:80
62.204.41.187:2078
189.253.206.105:443
176.67.56.94:443
103.116.178.85:995
197.87.182.115:443
143.0.219.6:995
109.12.111.14:443
189.146.87.77:443
47.157.227.70:443
24.139.72.117:443
79.80.80.29:2222
187.189.168.121:22
193.136.1.58:443
37.186.54.96:995
40.134.246.185:995
90.120.209.197:2078
96.37.113.36:993
86.97.247.161:2222
37.208.135.172:6883
72.27.33.160:443
208.101.82.0:443
89.86.33.217:443
189.37.80.240:443
86.98.149.168:2222
103.207.85.38:995
71.24.118.253:443
217.165.176.49:2222
109.178.178.110:995
121.7.223.45:2222
47.156.131.10:443
177.209.202.242:2222
41.86.42.158:995
106.51.48.170:50001
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Kzwnpnri = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Dtoagqalo = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1580 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 7 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\e50eceae = 5796d176a7bbf3a50ac2a3df46446aacc63649011a82554dad3115d98d6faafb98b7241804f0fb99f9c4677ba3e5a3bd61d9b0c1c58e9ac346591e2f333f825f38cd8ff07e3ec6b2a3bba09f35e586571ba537027b5e9576c8f7cad1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\98068124 = e3cfe4473c4336264619a9342c550710f6bf2faac983b74218b436d250497742753bdce5383bdc5ed6 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\20bae641 = 67fcd405296e6ef42cc5f5b9f51b06b544ae6d2c7e2fe2c5aeb52cde29600901ee083949d28110080c797d63023632f15029dfa395f7dc explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\6a6c59f9 = ba60a6efa71130c2e4767c7230d166c6b115414e6631d7af5e1a568bf8d6bc86b7e4e7e6ec69e8d91c900bdb2194d69c2c4a7a4e7ead1d0c8906 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\5ff389b7 = a604b2acf59687f8e4db69f982c0c0e8e2c2edda05b278a6ccacb401950ade12a19eda0c74b021ecd88f77b86254831ab91db9050a90e8f1385c62147a07e292dbed5ae8f299a2ab354201f8978758ece739d7bc64f21c7c1e003a02e299552f46990ebb1b64fac66e67637b32387000580a698f0bfadcf7699132dd05c4ae56a22af3c44f7b84a3380b12c27607cbcc9d397aa4e332086a6c42609ca591980e1db26f5274d4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Tyjoljx\5db2a9cb = ba44dafc8cce158bf10ea79661207a3ecbda0bb0744ee8e66afb19046b80c15c2e299c3bbeb109aa1cae8bbbee87d018a6d09eaa9b2ae04bef3920eb2f67b206e1a249d79fd3c8ae617f9cfb531cbd6f2c27353b906b59ab445a1df7b8976b5c4624bb34bac545ffc72b87 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exeexplorer.exeregsvr32.exepid process 1564 rundll32.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 1580 regsvr32.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe 896 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 1564 rundll32.exe 1580 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1536 wrote to memory of 1564 1536 rundll32.exe rundll32.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 1564 wrote to memory of 896 1564 rundll32.exe explorer.exe PID 896 wrote to memory of 592 896 explorer.exe schtasks.exe PID 896 wrote to memory of 592 896 explorer.exe schtasks.exe PID 896 wrote to memory of 592 896 explorer.exe schtasks.exe PID 896 wrote to memory of 592 896 explorer.exe schtasks.exe PID 1368 wrote to memory of 836 1368 taskeng.exe regsvr32.exe PID 1368 wrote to memory of 836 1368 taskeng.exe regsvr32.exe PID 1368 wrote to memory of 836 1368 taskeng.exe regsvr32.exe PID 1368 wrote to memory of 836 1368 taskeng.exe regsvr32.exe PID 1368 wrote to memory of 836 1368 taskeng.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 836 wrote to memory of 1580 836 regsvr32.exe regsvr32.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1580 wrote to memory of 1320 1580 regsvr32.exe explorer.exe PID 1320 wrote to memory of 2008 1320 explorer.exe reg.exe PID 1320 wrote to memory of 2008 1320 explorer.exe reg.exe PID 1320 wrote to memory of 2008 1320 explorer.exe reg.exe PID 1320 wrote to memory of 2008 1320 explorer.exe reg.exe PID 1320 wrote to memory of 1976 1320 explorer.exe reg.exe PID 1320 wrote to memory of 1976 1320 explorer.exe reg.exe PID 1320 wrote to memory of 1976 1320 explorer.exe reg.exe PID 1320 wrote to memory of 1976 1320 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn frgpmxu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dll\"" /SC ONCE /Z /ST 14:27 /ET 14:394⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {E7625356-1608-4C35-84DD-A75937E9A76F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Kzwnpnri" /d "0"5⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Dtoagqalo" /d "0"5⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qakbot_loader.dllFilesize
1.0MB
MD5433893e5a6e12aed9ec0400812690147
SHA14b4ca66c1818d2e5ff9f4ea2afb136af2bd96564
SHA2569c3d3cd9b0fcb39117692600a7296b68dddf2995c6d302bc9d9c8b786780ba19
SHA5123782c98a4ee96566b19577e586177f0d637e44c55a9072113035980cbbe02e524f9c7c6c8e5d06ee05a6e3f0875c6f8800ac120f02dd596c2d8f43ca9c7da435
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\qakbot_loader.dllFilesize
1.0MB
MD5433893e5a6e12aed9ec0400812690147
SHA14b4ca66c1818d2e5ff9f4ea2afb136af2bd96564
SHA2569c3d3cd9b0fcb39117692600a7296b68dddf2995c6d302bc9d9c8b786780ba19
SHA5123782c98a4ee96566b19577e586177f0d637e44c55a9072113035980cbbe02e524f9c7c6c8e5d06ee05a6e3f0875c6f8800ac120f02dd596c2d8f43ca9c7da435
-
memory/592-67-0x0000000000000000-mapping.dmp
-
memory/836-70-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmpFilesize
8KB
-
memory/836-69-0x0000000000000000-mapping.dmp
-
memory/896-62-0x0000000000000000-mapping.dmp
-
memory/896-64-0x0000000074681000-0x0000000074683000-memory.dmpFilesize
8KB
-
memory/896-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/896-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1320-87-0x00000000000C0000-0x00000000000E2000-memory.dmpFilesize
136KB
-
memory/1320-81-0x0000000000000000-mapping.dmp
-
memory/1564-61-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/1564-57-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/1564-54-0x0000000000000000-mapping.dmp
-
memory/1564-60-0x0000000000900000-0x0000000000932000-memory.dmpFilesize
200KB
-
memory/1564-59-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/1564-65-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/1564-58-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/1564-55-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1564-56-0x0000000000770000-0x000000000087C000-memory.dmpFilesize
1.0MB
-
memory/1580-72-0x0000000000000000-mapping.dmp
-
memory/1580-77-0x00000000006F0000-0x0000000000712000-memory.dmpFilesize
136KB
-
memory/1580-79-0x00000000006B0000-0x00000000006E2000-memory.dmpFilesize
200KB
-
memory/1580-80-0x00000000006F0000-0x0000000000712000-memory.dmpFilesize
136KB
-
memory/1580-78-0x00000000006F0000-0x0000000000712000-memory.dmpFilesize
136KB
-
memory/1580-76-0x00000000006F0000-0x0000000000712000-memory.dmpFilesize
136KB
-
memory/1580-85-0x00000000006F0000-0x0000000000712000-memory.dmpFilesize
136KB
-
memory/1580-75-0x0000000000A60000-0x0000000000B6C000-memory.dmpFilesize
1.0MB
-
memory/1976-88-0x0000000000000000-mapping.dmp
-
memory/2008-86-0x0000000000000000-mapping.dmp