Resubmissions
21-03-2023 19:15
230321-xx84fsef4x 1020-03-2023 14:45
230320-r4457aea57 1020-03-2023 13:11
230320-qfc65aff5z 1018-03-2023 21:48
230318-1nsa5aga2t 10Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 19:15
Static task
static1
Behavioral task
behavioral1
Sample
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
Resource
win7-20230220-en
General
-
Target
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
-
Size
294KB
-
MD5
118b1050be87b8189692b82df0ae3045
-
SHA1
f7ca1686e66866ce961a3b94bbee1d94b962a450
-
SHA256
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60
-
SHA512
abe0ae20a6a7a93bdbfe2909185a646b8eae6fdf31de0a1b51f51c79bf845974345448d105cf004e91539dcb81ca6fa504db85b822599a857aeed1f1bb46e5fb
-
SSDEEP
3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH
Malware Config
Extracted
qakbot
401.51
abc104
1606818862
79.119.124.237:443
87.218.53.206:2222
181.169.88.203:443
82.12.157.95:995
94.49.188.240:443
46.124.107.124:6881
86.122.248.164:2222
83.202.68.220:2222
79.129.216.215:2222
37.21.231.245:995
47.187.49.3:2222
2.90.33.130:443
149.28.98.196:995
149.28.99.97:443
45.63.107.192:995
149.28.98.196:2222
45.63.107.192:2222
74.73.27.35:443
149.28.98.196:443
144.202.38.185:2222
149.28.99.97:2222
45.77.193.83:443
144.202.38.185:995
24.95.61.62:443
95.77.223.148:443
71.187.170.235:443
39.36.30.92:995
188.26.243.119:443
78.187.125.116:2222
2.7.202.106:2222
178.80.62.24:443
91.104.44.226:995
81.214.126.173:2222
94.98.242.243:443
31.5.21.66:995
80.14.22.234:2222
98.121.187.78:443
47.44.217.98:443
82.10.43.130:2222
103.102.100.78:2222
45.118.65.34:443
176.45.233.94:995
81.247.148.252:995
211.24.72.253:443
189.231.3.63:443
41.227.76.249:443
156.222.155.185:995
75.136.40.155:443
92.154.83.96:2087
37.211.86.156:443
72.36.59.46:2222
219.76.148.249:443
2.50.56.81:443
47.21.192.182:2222
96.225.88.23:443
197.86.204.38:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
86.98.60.176:443
37.210.133.63:995
24.27.82.216:2222
82.127.125.209:20
79.115.171.106:2222
193.248.154.174:2222
172.78.30.215:443
79.166.96.86:2222
72.66.47.70:443
89.87.231.187:2222
72.29.181.78:2222
161.142.217.62:443
109.154.193.21:2222
86.245.87.251:2222
2.88.67.161:995
198.2.35.226:2222
83.110.206.115:995
2.89.183.206:443
151.16.241.219:443
110.142.205.182:443
85.98.177.32:443
78.181.19.134:443
102.185.242.27:443
90.101.117.122:2222
78.96.199.79:443
68.39.160.40:80
84.117.176.32:443
65.30.213.13:6882
42.201.228.106:995
80.195.103.146:2222
77.145.0.57:2222
94.59.236.155:995
1.43.86.247:2222
85.121.42.12:995
71.10.43.79:443
105.198.236.99:443
140.82.27.132:443
39.45.175.245:995
45.32.162.253:443
45.32.165.134:443
217.162.149.212:443
59.96.59.100:443
2.51.246.190:995
197.45.110.165:995
86.99.134.235:2222
24.179.13.119:443
176.181.247.197:443
68.131.19.52:443
86.98.34.84:995
184.21.136.237:995
65.131.47.74:995
185.105.131.233:443
81.133.234.36:2222
84.120.99.206:443
41.233.154.10:993
181.208.249.141:443
92.154.83.96:2222
92.154.83.96:1194
92.137.138.52:2222
175.140.23.200:443
46.177.174.186:443
203.106.195.67:443
172.87.157.235:443
121.58.199.24:443
151.60.163.18:443
73.51.245.231:995
37.210.131.246:443
151.27.89.199:443
41.237.210.179:995
94.69.112.148:2222
96.41.93.96:443
41.97.183.51:443
37.130.115.124:443
93.113.177.152:443
197.206.132.79:443
197.51.82.115:995
85.122.141.42:995
118.70.55.146:443
156.205.103.107:995
59.99.37.18:443
185.163.221.77:2222
39.32.55.12:995
62.38.114.12:2222
50.60.166.59:995
5.193.115.251:2222
58.152.9.133:443
196.151.252.84:443
120.151.95.167:443
178.222.114.132:995
97.119.234.37:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
qakbotty 5 IoCs
qakbotty triage.
Processes:
resource yara_rule behavioral2/memory/2820-136-0x0000000000F60000-0x0000000000F81000-memory.dmp _qakbot behavioral2/memory/2820-137-0x0000000000F60000-0x0000000000F81000-memory.dmp _qakbot behavioral2/memory/2820-138-0x0000000000F60000-0x0000000000F81000-memory.dmp _qakbot behavioral2/memory/2820-139-0x0000000000F60000-0x0000000000F81000-memory.dmp _qakbot behavioral2/memory/2820-140-0x0000000000F60000-0x0000000000F81000-memory.dmp _qakbot -
test_1 5 IoCs
big_bla.
Processes:
resource yara_rule behavioral2/memory/2820-136-0x0000000000F60000-0x0000000000F81000-memory.dmp qbot_bin behavioral2/memory/2820-137-0x0000000000F60000-0x0000000000F81000-memory.dmp qbot_bin behavioral2/memory/2820-138-0x0000000000F60000-0x0000000000F81000-memory.dmp qbot_bin behavioral2/memory/2820-139-0x0000000000F60000-0x0000000000F81000-memory.dmp qbot_bin behavioral2/memory/2820-140-0x0000000000F60000-0x0000000000F81000-memory.dmp qbot_bin -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4360 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2524 4360 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 2680 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exedescription pid process target process PID 1980 wrote to memory of 2680 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 2680 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 2680 1980 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2820 2680 rundll32.exe explorer.exe PID 2680 wrote to memory of 2820 2680 rundll32.exe explorer.exe PID 2680 wrote to memory of 2820 2680 rundll32.exe explorer.exe PID 2680 wrote to memory of 2820 2680 rundll32.exe explorer.exe PID 2680 wrote to memory of 2820 2680 rundll32.exe explorer.exe PID 2820 wrote to memory of 3660 2820 explorer.exe schtasks.exe PID 2820 wrote to memory of 3660 2820 explorer.exe schtasks.exe PID 2820 wrote to memory of 3660 2820 explorer.exe schtasks.exe PID 5088 wrote to memory of 4360 5088 regsvr32.exe regsvr32.exe PID 5088 wrote to memory of 4360 5088 regsvr32.exe regsvr32.exe PID 5088 wrote to memory of 4360 5088 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kixgkoem /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll\"" /SC ONCE /Z /ST 20:17 /ET 20:294⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 5843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4360 -ip 43601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dllFilesize
294KB
MD51aeb8292cc38c2bc96d110c07ed9faba
SHA105afd21fbb99799ef19e431f64ececa36acff4b7
SHA25607bd42d913cc973aaa4a192609211a8d98f4453bf647a8803b1844644e990734
SHA512f09c1f63deacf334c09501a1b1ee1e98764c746262707b29bce6cd0ef89258820376e5f7f6ac02375cd559a3d639340eccf98c0a7302a24e291552985df6b4e5
-
C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dllFilesize
294KB
MD51aeb8292cc38c2bc96d110c07ed9faba
SHA105afd21fbb99799ef19e431f64ececa36acff4b7
SHA25607bd42d913cc973aaa4a192609211a8d98f4453bf647a8803b1844644e990734
SHA512f09c1f63deacf334c09501a1b1ee1e98764c746262707b29bce6cd0ef89258820376e5f7f6ac02375cd559a3d639340eccf98c0a7302a24e291552985df6b4e5
-
memory/2680-133-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/2680-134-0x0000000001310000-0x000000000135A000-memory.dmpFilesize
296KB
-
memory/2820-136-0x0000000000F60000-0x0000000000F81000-memory.dmpFilesize
132KB
-
memory/2820-137-0x0000000000F60000-0x0000000000F81000-memory.dmpFilesize
132KB
-
memory/2820-138-0x0000000000F60000-0x0000000000F81000-memory.dmpFilesize
132KB
-
memory/2820-139-0x0000000000F60000-0x0000000000F81000-memory.dmpFilesize
132KB
-
memory/2820-140-0x0000000000F60000-0x0000000000F81000-memory.dmpFilesize
132KB
-
memory/4360-144-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB