Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 20:37
Static task
static1
Behavioral task
behavioral1
Sample
972d75aeda58274d396e5adf1ad35e5a.dll
Resource
win7-20231215-en
General
-
Target
972d75aeda58274d396e5adf1ad35e5a.dll
-
Size
253KB
-
MD5
972d75aeda58274d396e5adf1ad35e5a
-
SHA1
186d436bbdea3b692ac74886570071647e8e0456
-
SHA256
d53b819e793ac21a76cfb93afd3a5ae424d629dbfcb61d48f3a32a2e8e18d438
-
SHA512
b3078a5513e88de447e1bbef16ea385bfa95b0591035dbbebf780b42333c53abe1e3ab77ffb0d684ce5d914662dc529b4ee9c98d11821d806e9ba0019515b05d
-
SSDEEP
3072:0PQdEOItJPxluIalXQOr+nxQNBO0jTL23i7eBnaVImWeqSR4G78SYSuDSMv6UWv:MUr+nxQNBO0jf2Ee5aSzeF4DSY7Dh6R
Malware Config
Extracted
qakbot
402.343
obama105
1632819007
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
196.217.156.63:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Xabweuw = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Uoulsb = "0" reg.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1652 regsvr32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 10 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\3f9239a3 = d718b3a38bef664f77993fe7cf522943e1b5d4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\84cc991 = 81f674bdb8a07497c89bc3fb79834ed5dc8324ea9c36281fcc690f68a400945ff2812ad0656e5dde3ea607b98fe8b6cdb83497dd529c862fbde8b666 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\cdf8e17e = 4e8ebb39839e19c20db30fc483ebeee96a3ee2277f688fc7bbeb398b0814591a2490080a29645959eef976f4a66e7bdc2d35ff34b50b8370594a6f0bbaef explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\7544861b = 1bc603808caefb7000471cde120eb2c271ea17c5a3cf3ab0cf33442c75238de46c4eebaaf188f1dfce5f6a34f3d8a7a4ad35759d210c4e885500a6ff5d368ffc439152aa explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\40db5655 = 4c7beb9d75c47dbc93fe7523115aa6f6734f9102913290c3a64818acccd6fa3a66580a01d0b400e88a9f7a8d2f2c56efe081371b8f5d5c1cda0726b273c0a6e9c2728c284ff8a72ec3ad788b8eaf explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\a0de9ed = 23659def559b29798462ed83d7d3f51ae906111bd6d6eb3c4ca9d25e5e06e011f775c9c87e11472fd3a54ceb69adade54df4401613c1a5241819f955af2e8ca67a4baa8e42e48c505134fff1050d3fcd66610dfffc1b140b4d6776c337573325d4e5daefce312e33fd358872da6ee2ffa3455df337724d2bf59f17 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\b0f0aef4 = cd2d5acadb765d29f8faef224df9ab6c5af5daf3bce75799c8393bb53145 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\b2b18e88 = e0533761d2b374c50ed7e76f4d7dc0fb7086849c4255907f1cd252c0a1bc442f3aa0051073d7c3e9fec457da7547b9f2179f83cf1e20d89a06e4ff78fd105f4b356dfc1aac3bbdef4fcae6e79c480b12e1e4aaadbf062cda explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Uaoeaipeoai\3f9239a3 = d718a4a38bef5317cbb6f355991f09446a35a62128be6370b0c716002e885aeab2e67d8aed6294e2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2192 rundll32.exe 2192 rundll32.exe 1652 regsvr32.exe 1652 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rundll32.exeregsvr32.exepid process 2192 rundll32.exe 1652 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
rundll32.exerundll32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 3876 wrote to memory of 2192 3876 rundll32.exe rundll32.exe PID 3876 wrote to memory of 2192 3876 rundll32.exe rundll32.exe PID 3876 wrote to memory of 2192 3876 rundll32.exe rundll32.exe PID 2192 wrote to memory of 1236 2192 rundll32.exe explorer.exe PID 2192 wrote to memory of 1236 2192 rundll32.exe explorer.exe PID 2192 wrote to memory of 1236 2192 rundll32.exe explorer.exe PID 2192 wrote to memory of 1236 2192 rundll32.exe explorer.exe PID 2192 wrote to memory of 1236 2192 rundll32.exe explorer.exe PID 1236 wrote to memory of 3220 1236 explorer.exe schtasks.exe PID 1236 wrote to memory of 3220 1236 explorer.exe schtasks.exe PID 1236 wrote to memory of 3220 1236 explorer.exe schtasks.exe PID 468 wrote to memory of 1652 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 1652 468 regsvr32.exe regsvr32.exe PID 468 wrote to memory of 1652 468 regsvr32.exe regsvr32.exe PID 1652 wrote to memory of 4148 1652 regsvr32.exe explorer.exe PID 1652 wrote to memory of 4148 1652 regsvr32.exe explorer.exe PID 1652 wrote to memory of 4148 1652 regsvr32.exe explorer.exe PID 1652 wrote to memory of 4148 1652 regsvr32.exe explorer.exe PID 1652 wrote to memory of 4148 1652 regsvr32.exe explorer.exe PID 4148 wrote to memory of 3344 4148 explorer.exe reg.exe PID 4148 wrote to memory of 3344 4148 explorer.exe reg.exe PID 4148 wrote to memory of 1604 4148 explorer.exe reg.exe PID 4148 wrote to memory of 1604 4148 explorer.exe reg.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn xiimqeq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dll\"" /SC ONCE /Z /ST 11:50 /ET 12:024⤵
- Creates scheduled task(s)
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uoulsb" /d "0"4⤵
- Windows security bypass
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Xabweuw" /d "0"4⤵
- Windows security bypass
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\972d75aeda58274d396e5adf1ad35e5a.dllFilesize
253KB
MD5972d75aeda58274d396e5adf1ad35e5a
SHA1186d436bbdea3b692ac74886570071647e8e0456
SHA256d53b819e793ac21a76cfb93afd3a5ae424d629dbfcb61d48f3a32a2e8e18d438
SHA512b3078a5513e88de447e1bbef16ea385bfa95b0591035dbbebf780b42333c53abe1e3ab77ffb0d684ce5d914662dc529b4ee9c98d11821d806e9ba0019515b05d
-
memory/1236-4-0x0000000000A00000-0x0000000000A21000-memory.dmpFilesize
132KB
-
memory/1236-5-0x0000000000A00000-0x0000000000A21000-memory.dmpFilesize
132KB
-
memory/1236-0-0x0000000000A00000-0x0000000000A21000-memory.dmpFilesize
132KB
-
memory/1236-6-0x0000000000A00000-0x0000000000A21000-memory.dmpFilesize
132KB
-
memory/1236-8-0x0000000000A00000-0x0000000000A21000-memory.dmpFilesize
132KB
-
memory/1652-13-0x0000000010000000-0x0000000016278000-memory.dmpFilesize
98.5MB
-
memory/2192-1-0x0000000010000000-0x0000000016278000-memory.dmpFilesize
98.5MB
-
memory/4148-12-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB
-
memory/4148-15-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB
-
memory/4148-16-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB
-
memory/4148-17-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB
-
memory/4148-19-0x0000000000330000-0x0000000000351000-memory.dmpFilesize
132KB