Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    137s
  • resource
    win10v191014
  • submitted
    06/12/2019, 16:08

Sharing

Copy URL Twitter E-mail

General

  • Target
    update.bin.exe
  • Sample191206-s2wazv1yle
  • SHA256 983ea66816fa3e0a089be5ac33e8f3e2ff92b53e804389805fc591ea12cf09d0
Score
10/10
evasiontrojanbankerstealerqakbotspreadingpersistence

Malware Config

Extracted

Family

  • qakbot

Campaign

  • 1575272833

C2

  • 173.172.205.216:995

  • 71.77.231.251:443

  • 75.110.250.89:443

  • 72.190.101.70:443

  • 12.5.37.3:995

  • 68.49.120.179:443

  • 184.74.101.234:995

  • 24.30.71.200:443

  • 100.4.185.8:443

  • 72.218.167.183:443

  • 80.14.209.42:2222

  • 187.206.88.42:995

  • 104.34.122.18:443

  • 81.103.144.77:443

  • 75.110.219.10:443

  • 12.5.37.3:443

  • 74.134.35.54:443

  • 70.183.3.199:443

  • 64.250.55.239:443

  • 75.142.59.167:443

Signatures

  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Adds Run entry to start application 2 TTPs 1 IoCs
    persistence
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Runs ping.exe 1 TTPs 1 IoCs
    evasionspreading
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities

    trojanbankerstealerqakbot
  • Drops file in Windows directory 1 IoCs
  • Turn off Windows Defender SpyNet reporting 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\update.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\update.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\update.bin.exe
      C:\Users\Admin\AppData\Local\Temp\update.bin.exe /C
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:5052
    • C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:2904
      • C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe /C
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Executes dropped EXE
        PID:4008
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4048
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ctbnemtyqp /tr "\"C:\Users\Admin\AppData\Local\Temp\update.bin.exe\" /I ctbnemtyqp" /SC ONCE /Z /ST 17:10 /ET 17:22
      2⤵
        PID:2896
    • C:\Windows\system32\SppExtComObj.exe
      C:\Windows\system32\SppExtComObj.exe -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Windows\System32\SLUI.exe
        "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
        2⤵
          PID:5112
      • C:\Users\Admin\AppData\Local\Temp\update.bin.exe
        C:\Users\Admin\AppData\Local\Temp\update.bin.exe /I ctbnemtyqp
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
          2⤵
            PID:4624
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
            2⤵
              PID:4636
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
              2⤵
                PID:4604
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                2⤵
                  PID:4712
                • C:\Windows\system32\reg.exe
                  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
                  2⤵
                    PID:4724
                  • C:\Windows\system32\reg.exe
                    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                    2⤵
                      PID:4384
                    • C:\Windows\system32\reg.exe
                      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
                      2⤵
                        PID:3688
                      • C:\Windows\system32\reg.exe
                        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                        2⤵
                          PID:4840
                        • C:\Windows\system32\reg.exe
                          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn" /d "0"
                          2⤵
                            PID:4324
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
                            C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            • Executes dropped EXE
                            PID:4228
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Tykyugvn\ldzgsvy.exe /C
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Executes dropped EXE
                              PID:4160
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\update.bin.exe"
                            2⤵
                              PID:4128
                              • C:\Windows\system32\PING.EXE
                                ping.exe -n 6 127.0.0.1
                                3⤵
                                • Runs ping.exe
                                PID:4136
                            • C:\Windows\system32\schtasks.exe
                              "C:\Windows\system32\schtasks.exe" /DELETE /F /TN ctbnemtyqp
                              2⤵
                                PID:4152
                            • \??\c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                              1⤵
                              • Drops file in Windows directory
                              PID:2652
                            • \??\c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                              1⤵
                                PID:4888
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
                                1⤵
                                  PID:4012
                                • \??\c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k unistacksvcgroup
                                  1⤵
                                    PID:3444
                                  • \??\c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
                                    1⤵
                                      PID:668

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          memory/2904-5-0x00000000029D0000-0x0000000002A62000-memory.dmp
                                          Download

                                          memory/4008-4-0x0000000002A00000-0x0000000002A01000-memory.dmp
                                          Download

                                          memory/4160-9-0x0000000002810000-0x0000000002811000-memory.dmp
                                          Download

                                          memory/5052-0-0x00000000029A0000-0x00000000029A1000-memory.dmp
                                          Download