Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    138s
  • max time network
    151s
  • resource
    win10v191014
  • submitted
    11-11-2019 10:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8.bin.exe

  • Size

    757KB

  • MD5

    37bb4d9f1bd92067748c2d86dc487105

  • SHA1

    aa8ccf3c1a22c3102c604f63964ccf4751d15288

  • SHA256

    eb17935cf972d90be92c9b39fff8b3d760ecda78a6f602cb2b8bbaf3d87e6b61

  • SHA512

    da67ef1ef3ddfc7c3a9bbc6d0bc42935ac737f2fbf98a102a0aef92358e20b94163701e21786447c56d772f5c0a16170834c1b34b0ce0ae93ac2d20f4ad7a4b4

Score
10/10
persistenceevasiontrojanbankerstealerqakbot

Malware Config

Extracted

Family

qakbot

Campaign

1573401612

Credentials

  • Protocol:     ftp
  • Host:
    192.185.5.208
  • Port:
    21
  • Username:
    logger@dustinkeeling.com
  • Password:
    NxdkxAp4dUsY

  • Protocol:     ftp
  • Host:
    162.241.218.118
  • Port:
    21
  • Username:
    logger@misterexterior.com
  • Password:
    EcOV0DyGVgVN

  • Protocol:     ftp
  • Host:
    69.89.31.139
  • Port:
    21
  • Username:
    cpanel@vivekharris-architects.com
  • Password:
    fcR7OvyLrMW6!

  • Protocol:     ftp
  • Host:
    169.207.67.14
  • Port:
    21
  • Username:
    cpanel@dovetailsolar.com
  • Password:
    eQyicNLzzqPN
C2

50.246.229.50:443

74.134.35.54:443

75.110.219.10:443

65.16.241.150:443

74.134.4.236:443

182.56.93.78:995

184.191.62.78:443

76.181.237.223:443

2.50.41.185:443

107.12.140.181:443

72.29.181.77:2078

73.137.187.150:443

71.93.60.90:443

72.46.151.196:995

173.233.182.249:443

67.10.18.112:993

181.47.60.21:995

97.83.66.143:443

184.74.101.234:995

181.1.204.139:443

Signatures

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Drops file in Windows directory 1 IoCs
  • Turns off Windows Defender SpyNet reporting 6 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Windows security modification 2 TTPs 11 IoCs
    evasiontrojan
  • Adds Run entry to start application 2 TTPs 1 IoCs
    persistence
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\8.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\8.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\8.bin.exe
      C:\Users\Admin\AppData\Local\Temp\8.bin.exe /C
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Checks SCSI registry key(s)
      PID:4928
    • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1340
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Adds Run entry to start application
        PID:64
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jncrkib /tr "\"C:\Users\Admin\AppData\Local\Temp\8.bin.exe\" /I jncrkib" /SC ONCE /Z /ST 11:29 /ET 11:41
      2⤵
      • Creates scheduled task(s)
      PID:364
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:5072
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Modifies service
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:3676
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
      • Modifies service
      PID:4536
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
      1⤵
      • Checks system information in the registry
      PID:3992
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k unistacksvcgroup
      1⤵
        PID:3916
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
        1⤵
        • Modifies service
        • Windows security modification
        • System policy modification
        • Checks whether UAC is enabled
        PID:2444
      • C:\Users\Admin\AppData\Local\Temp\8.bin.exe
        C:\Users\Admin\AppData\Local\Temp\8.bin.exe /I jncrkib
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:796
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
          2⤵
          • Turns off Windows Defender SpyNet reporting
          • Windows security modification
          PID:720
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
          2⤵
          • Turns off Windows Defender SpyNet reporting
          • Windows security modification
          PID:5028
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
          2⤵
            PID:3528
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
            2⤵
              PID:1972
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
              2⤵
              • Turns off Windows Defender SpyNet reporting
              • Windows security modification
              PID:5080
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
              2⤵
              • Turns off Windows Defender SpyNet reporting
              • Windows security modification
              PID:3180
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
              2⤵
              • Turns off Windows Defender SpyNet reporting
              • Windows security modification
              PID:4880
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
              2⤵
              • Turns off Windows Defender SpyNet reporting
              • Windows security modification
              PID:4232
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr" /d "0"
              2⤵
              • Windows security bypass
              PID:4260
            • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1020
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:68
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8.bin.exe"
              2⤵
                PID:3568
                • C:\Windows\system32\PING.EXE
                  ping.exe -n 6 127.0.0.1
                  3⤵
                  • Runs ping.exe
                  PID:832
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /DELETE /F /TN jncrkib
                2⤵
                  PID:3512

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Scheduled Task

              1
              T1053

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              5
              T1112

              Disabling Security Tools

              2
              T1089

              Credential Access

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              Remote System Discovery

              1
              T1018

              Peripheral Device Discovery

              1
              T1120

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.dat
                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe
                Download Submit
              • memory/68-20-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1340-4-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1728-5-0x0000000002BC0000-0x0000000002C52000-memory.dmp
                Filesize

                584KB

                Download
              • memory/4928-0-0x0000000002C30000-0x0000000002C31000-memory.dmp
                Filesize

                4KB

                Download