Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 19:06
General
-
Target
c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll
-
Size
543KB
-
MD5
ffaf9cd085434fd5230511ab895ba494
-
SHA1
9e49d29d66d380255e5e8e2ccf19f5b51eb92001
-
SHA256
c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a
-
SHA512
01890758e839b3eb90dc3711dd470ba1e232798ed0f62d89185e450877161fd321b5b125ab0a64f270c2f37ef129f59eb5848164d26fb4965534d77a0d4f2300
-
SSDEEP
12288:DSG3daX8glK/McVThyhRBof4byx7ILypuLT+CLWNhM3Q2Bz:DSc3l/ML3bypxOT+CLsu
Malware Config
Extracted
qakbot
403.573
AA
1649660679
41.228.22.180:443
47.23.89.62:995
176.67.56.94:443
103.107.113.120:443
148.64.96.100:443
47.180.172.159:443
181.118.183.98:443
140.82.49.12:443
103.87.95.133:2222
96.21.251.127:2222
197.167.62.14:993
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
80.11.74.81:2222
66.98.42.102:443
75.99.168.194:61201
173.174.216.62:443
45.9.20.200:443
39.41.158.185:995
187.207.48.194:61202
41.84.237.10:995
93.48.80.198:995
105.226.83.196:995
144.202.2.175:443
45.76.167.26:995
144.202.3.39:443
144.202.3.39:995
140.82.63.183:443
45.63.1.12:995
140.82.63.183:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
149.28.238.199:995
47.180.172.159:50010
71.13.93.154:2222
86.98.33.141:443
31.35.28.29:443
113.11.89.165:995
175.145.235.37:443
117.248.109.38:21
94.59.138.62:2222
32.221.224.140:995
5.95.58.211:2087
81.215.196.174:443
176.88.238.122:995
94.59.138.62:1194
92.132.172.197:2222
70.46.220.114:443
78.87.206.213:995
197.89.108.252:443
39.44.144.159:995
176.205.119.81:2078
91.177.173.10:995
72.76.94.99:443
24.178.196.158:2222
1.161.71.109:995
172.114.160.81:995
173.21.10.71:2222
1.161.71.109:443
86.97.11.43:443
217.128.122.65:2222
86.98.33.141:995
203.122.46.130:443
89.211.181.64:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.97:2222
202.134.152.2:2222
120.150.218.241:995
45.46.53.140:2222
180.129.102.214:995
217.164.210.192:443
217.165.147.83:993
84.241.8.23:32103
180.183.128.80:2222
74.15.2.252:2222
76.70.9.169:2222
47.23.89.62:993
75.113.214.234:2222
208.107.221.224:443
76.169.147.192:32103
190.73.3.148:2222
76.69.155.202:2222
96.29.208.97:443
108.60.213.141:443
75.99.168.194:443
182.191.92.203:995
73.151.236.31:443
38.70.253.226:2222
39.52.75.201:995
121.74.167.191:995
201.211.64.196:2222
71.74.12.34:443
191.99.191.28:443
85.246.82.244:443
101.50.103.193:995
182.253.189.74:2222
67.209.195.198:443
90.120.65.153:2078
37.34.253.233:443
96.37.113.36:993
181.62.0.59:443
41.38.167.179:995
197.205.127.234:443
45.241.232.25:995
185.69.144.209:443
2.50.137.197:443
73.67.152.98:2222
76.25.142.196:443
125.168.47.127:2222
201.145.189.252:443
109.12.111.14:443
102.182.232.3:995
72.12.115.90:22
47.156.191.217:443
174.69.215.101:443
70.51.138.126:2222
186.105.121.166:443
179.158.105.44:443
94.36.195.250:2222
109.228.220.196:443
120.61.2.95:443
103.88.226.30:443
103.139.243.207:990
68.204.7.158:443
196.233.79.3:80
39.57.76.82:995
187.250.114.15:443
103.246.242.202:443
190.252.242.69:443
5.32.41.45:443
100.1.108.246:443
72.252.201.34:995
191.17.223.93:32101
40.134.246.185:995
187.102.135.142:2222
191.34.199.129:443
181.208.248.227:443
138.204.24.70:443
209.197.176.40:995
42.235.146.7:2222
82.152.39.39:443
41.230.62.211:993
31.48.166.122:2078
187.251.132.144:22
143.0.34.185:443
88.228.250.126:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Jjiewipouh = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Wjtwty = "0" reg.exe -
Loads dropped DLL 1 IoCs
pid Process 2536 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2144 schtasks.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\6b8c5fb7 = d71cc6517cc8444120104646fe1f2b1239acbb41da3e0fbfee3d34880256d17f1e2a100e35411aca5c52afafd910816bad0419bb71a86a2e1e5ebcf20971cd118fc95127ecca55744a78247774fd05bfe8e7b2 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\5e138ff9 = ef26f37c66b7b5ff2b78fa71de22f89edadbda2e270cc321fef5917dfe501ceef97aaa8f4a904e6a50075baf20d1c70afb2e5b1cf4bd80cd45259c7d67b81238987391a0f0c8f36f40e16c3d3a1bf4ceadf6599767f5a2f6e376625043b54a040da33772dca9c36134133a7f8fe9427aed0a5ad9779617beb30c37ccfb7c70c1e8312fd3fdc80d6b611b9cbaba20e0bd33f525dc46d6e7798429d502c17ab96c9ac768ca7b4df5f1c70ce32bd4b0e457a26822 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\5c52af85 = f98771e4ec817fceb75ac0fcc940a72f1bd8b4d4ff9f34e02ab3d7ae611e4885c0fef1bba3629890c3e66e1082c3c9541bc8652ff3d666ecff7af2321538d10e49595a30f6bf737f3e1aa7ed513628b20baf497ab7089fa018d2eae178c208e15bb479fac139618e26e68e80 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\e4eec8e0 = a92aac5f6d4ccf475ca927a9437a95a0c6901d9c090310563b34f5eb43b50bf0f3c8aa5ab747a4649f2489 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\215ae00f = 4c158d3578e61f943b3440326edaad81f008aeb19da5b6d21067b47425c6248e2c65b1b7ef42c48e92482b1ae47f354078f760f538c9e5fd457a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\14c53041 = 4170fb32603620cf9ffed6747d82d6963561766529eab765800109ce3cf34d56e4b8b30e12993b11451223f3eea026e0ece7a65c1de6cf70f17032f5cc96b2cb4410fc6588950c07def3d89f66cea1b8f64dc046e53f9d8a46958f43897bd553b280a7766d877f explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\99e6876a = 2ab86343a321703f346740acd36f56 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\e6afe89c = 762a79ca0bf294873406437295f21bc8399d9ef24b4cdfc4200f648f41cfcec1906fbf960419179e2784d5b50b22c1900995c200d448a9 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Fmjyohsn\6b8c5fb7 = d71cd1517cc871818de0b13dfccf6797db5445fae3c414ece4a069ad371b0e0727bb644585b2625acbe796ec8f6f6e531dd31dd506e6e24c920ad135a7e89631c1822273bb5f66015cc6a90d133c023ed1caf20f147ef6e5fb59d2de03dbc3a5cd42783d933ca4b0 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 regsvr32.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2536 regsvr32.exe 2184 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2128 regsvr32.exe 2536 regsvr32.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2336 wrote to memory of 2128 2336 regsvr32.exe 28 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2128 wrote to memory of 2184 2128 regsvr32.exe 29 PID 2184 wrote to memory of 2144 2184 explorer.exe 30 PID 2184 wrote to memory of 2144 2184 explorer.exe 30 PID 2184 wrote to memory of 2144 2184 explorer.exe 30 PID 2184 wrote to memory of 2144 2184 explorer.exe 30 PID 2080 wrote to memory of 2176 2080 taskeng.exe 36 PID 2080 wrote to memory of 2176 2080 taskeng.exe 36 PID 2080 wrote to memory of 2176 2080 taskeng.exe 36 PID 2080 wrote to memory of 2176 2080 taskeng.exe 36 PID 2080 wrote to memory of 2176 2080 taskeng.exe 36 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2176 wrote to memory of 2536 2176 regsvr32.exe 35 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 2536 wrote to memory of 1620 2536 regsvr32.exe 37 PID 1620 wrote to memory of 804 1620 explorer.exe 39 PID 1620 wrote to memory of 804 1620 explorer.exe 39 PID 1620 wrote to memory of 804 1620 explorer.exe 39 PID 1620 wrote to memory of 804 1620 explorer.exe 39 PID 1620 wrote to memory of 2716 1620 explorer.exe 41 PID 1620 wrote to memory of 2716 1620 explorer.exe 41 PID 1620 wrote to memory of 2716 1620 explorer.exe 41 PID 1620 wrote to memory of 2716 1620 explorer.exe 41
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dlkzihzrjy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll\"" /SC ONCE /Z /ST 19:08 /ET 19:204⤵
- Creates scheduled task(s)
PID:2144
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1D31A009-27C2-42B5-9977-BC4C8D736053} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:2176
-
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Jjiewipouh" /d "0"3⤵
- Windows security bypass
PID:804
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wjtwty" /d "0"3⤵
- Windows security bypass
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a.dll
Filesize543KB
MD5ffaf9cd085434fd5230511ab895ba494
SHA19e49d29d66d380255e5e8e2ccf19f5b51eb92001
SHA256c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a
SHA51201890758e839b3eb90dc3711dd470ba1e232798ed0f62d89185e450877161fd321b5b125ab0a64f270c2f37ef129f59eb5848164d26fb4965534d77a0d4f2300