Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 10:08
Static task
static1
Behavioral task
behavioral1
Sample
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
Resource
win10v2004-20230220-en
General
-
Target
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
-
Size
294KB
-
MD5
118b1050be87b8189692b82df0ae3045
-
SHA1
f7ca1686e66866ce961a3b94bbee1d94b962a450
-
SHA256
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60
-
SHA512
abe0ae20a6a7a93bdbfe2909185a646b8eae6fdf31de0a1b51f51c79bf845974345448d105cf004e91539dcb81ca6fa504db85b822599a857aeed1f1bb46e5fb
-
SSDEEP
3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH
Malware Config
Extracted
qakbot
401.51
abc104
1606818862
79.119.124.237:443
87.218.53.206:2222
181.169.88.203:443
82.12.157.95:995
94.49.188.240:443
46.124.107.124:6881
86.122.248.164:2222
83.202.68.220:2222
79.129.216.215:2222
37.21.231.245:995
47.187.49.3:2222
2.90.33.130:443
149.28.98.196:995
149.28.99.97:443
45.63.107.192:995
149.28.98.196:2222
45.63.107.192:2222
74.73.27.35:443
149.28.98.196:443
144.202.38.185:2222
149.28.99.97:2222
45.77.193.83:443
144.202.38.185:995
24.95.61.62:443
95.77.223.148:443
71.187.170.235:443
39.36.30.92:995
188.26.243.119:443
78.187.125.116:2222
2.7.202.106:2222
178.80.62.24:443
91.104.44.226:995
81.214.126.173:2222
94.98.242.243:443
31.5.21.66:995
80.14.22.234:2222
98.121.187.78:443
47.44.217.98:443
82.10.43.130:2222
103.102.100.78:2222
45.118.65.34:443
176.45.233.94:995
81.247.148.252:995
211.24.72.253:443
189.231.3.63:443
41.227.76.249:443
156.222.155.185:995
75.136.40.155:443
92.154.83.96:2087
37.211.86.156:443
72.36.59.46:2222
219.76.148.249:443
2.50.56.81:443
47.21.192.182:2222
96.225.88.23:443
197.86.204.38:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
86.98.60.176:443
37.210.133.63:995
24.27.82.216:2222
82.127.125.209:20
79.115.171.106:2222
193.248.154.174:2222
172.78.30.215:443
79.166.96.86:2222
72.66.47.70:443
89.87.231.187:2222
72.29.181.78:2222
161.142.217.62:443
109.154.193.21:2222
86.245.87.251:2222
2.88.67.161:995
198.2.35.226:2222
83.110.206.115:995
2.89.183.206:443
151.16.241.219:443
110.142.205.182:443
85.98.177.32:443
78.181.19.134:443
102.185.242.27:443
90.101.117.122:2222
78.96.199.79:443
68.39.160.40:80
84.117.176.32:443
65.30.213.13:6882
42.201.228.106:995
80.195.103.146:2222
77.145.0.57:2222
94.59.236.155:995
1.43.86.247:2222
85.121.42.12:995
71.10.43.79:443
105.198.236.99:443
140.82.27.132:443
39.45.175.245:995
45.32.162.253:443
45.32.165.134:443
217.162.149.212:443
59.96.59.100:443
2.51.246.190:995
197.45.110.165:995
86.99.134.235:2222
24.179.13.119:443
176.181.247.197:443
68.131.19.52:443
86.98.34.84:995
184.21.136.237:995
65.131.47.74:995
185.105.131.233:443
81.133.234.36:2222
84.120.99.206:443
41.233.154.10:993
181.208.249.141:443
92.154.83.96:2222
92.154.83.96:1194
92.137.138.52:2222
175.140.23.200:443
46.177.174.186:443
203.106.195.67:443
172.87.157.235:443
121.58.199.24:443
151.60.163.18:443
73.51.245.231:995
37.210.131.246:443
151.27.89.199:443
41.237.210.179:995
94.69.112.148:2222
96.41.93.96:443
41.97.183.51:443
37.130.115.124:443
93.113.177.152:443
197.206.132.79:443
197.51.82.115:995
85.122.141.42:995
118.70.55.146:443
156.205.103.107:995
59.99.37.18:443
185.163.221.77:2222
39.32.55.12:995
62.38.114.12:2222
50.60.166.59:995
5.193.115.251:2222
58.152.9.133:443
196.151.252.84:443
120.151.95.167:443
178.222.114.132:995
97.119.234.37:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3392-136-0x0000000000FD0000-0x0000000000FF1000-memory.dmp MAL_RANSOM_Crime_QakBot_Mar2023 behavioral2/memory/3392-137-0x0000000000FD0000-0x0000000000FF1000-memory.dmp MAL_RANSOM_Crime_QakBot_Mar2023 behavioral2/memory/3392-138-0x0000000000FD0000-0x0000000000FF1000-memory.dmp MAL_RANSOM_Crime_QakBot_Mar2023 behavioral2/memory/3392-140-0x0000000000FD0000-0x0000000000FF1000-memory.dmp MAL_RANSOM_Crime_QakBot_Mar2023 behavioral2/memory/3392-141-0x0000000000FD0000-0x0000000000FF1000-memory.dmp MAL_RANSOM_Crime_QakBot_Mar2023 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3544 regsvr32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3376 3544 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1968 rundll32.exe 1968 rundll32.exe 1968 rundll32.exe 1968 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1968 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exedescription pid process target process PID 1820 wrote to memory of 1968 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1968 1820 rundll32.exe rundll32.exe PID 1820 wrote to memory of 1968 1820 rundll32.exe rundll32.exe PID 1968 wrote to memory of 3392 1968 rundll32.exe explorer.exe PID 1968 wrote to memory of 3392 1968 rundll32.exe explorer.exe PID 1968 wrote to memory of 3392 1968 rundll32.exe explorer.exe PID 1968 wrote to memory of 3392 1968 rundll32.exe explorer.exe PID 1968 wrote to memory of 3392 1968 rundll32.exe explorer.exe PID 3392 wrote to memory of 2768 3392 explorer.exe schtasks.exe PID 3392 wrote to memory of 2768 3392 explorer.exe schtasks.exe PID 3392 wrote to memory of 2768 3392 explorer.exe schtasks.exe PID 2292 wrote to memory of 3544 2292 regsvr32.exe regsvr32.exe PID 2292 wrote to memory of 3544 2292 regsvr32.exe regsvr32.exe PID 2292 wrote to memory of 3544 2292 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ebeeixxgrc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll\"" /SC ONCE /Z /ST 11:12 /ET 11:244⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 5843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3544 -ip 35441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dllFilesize
294KB
MD51aeb8292cc38c2bc96d110c07ed9faba
SHA105afd21fbb99799ef19e431f64ececa36acff4b7
SHA25607bd42d913cc973aaa4a192609211a8d98f4453bf647a8803b1844644e990734
SHA512f09c1f63deacf334c09501a1b1ee1e98764c746262707b29bce6cd0ef89258820376e5f7f6ac02375cd559a3d639340eccf98c0a7302a24e291552985df6b4e5
-
C:\Users\Admin\AppData\Local\Temp\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dllFilesize
294KB
MD51aeb8292cc38c2bc96d110c07ed9faba
SHA105afd21fbb99799ef19e431f64ececa36acff4b7
SHA25607bd42d913cc973aaa4a192609211a8d98f4453bf647a8803b1844644e990734
SHA512f09c1f63deacf334c09501a1b1ee1e98764c746262707b29bce6cd0ef89258820376e5f7f6ac02375cd559a3d639340eccf98c0a7302a24e291552985df6b4e5
-
memory/1968-133-0x0000000010000000-0x000000001004A000-memory.dmpFilesize
296KB
-
memory/1968-134-0x0000000000FD0000-0x000000000101A000-memory.dmpFilesize
296KB
-
memory/3392-136-0x0000000000FD0000-0x0000000000FF1000-memory.dmpFilesize
132KB
-
memory/3392-137-0x0000000000FD0000-0x0000000000FF1000-memory.dmpFilesize
132KB
-
memory/3392-138-0x0000000000FD0000-0x0000000000FF1000-memory.dmpFilesize
132KB
-
memory/3392-140-0x0000000000FD0000-0x0000000000FF1000-memory.dmpFilesize
132KB
-
memory/3392-141-0x0000000000FD0000-0x0000000000FF1000-memory.dmpFilesize
132KB