MSG_986000.vbs

General
Target

MSG_986000.vbs

Filesize

5MB

Completed

03-03-2020 15:46

Score
10 /10
MD5

bb7fbcd342edcef5b43904fe867edc2c

SHA1

a6852667b3de27e6d6eb5820fd2d5267479bdffa

SHA256

d41c66a9160ce7f0dd0d1360d8b8339a8276fc30215f4623ca88d0efad319346

Malware Config
Signatures 9

Filter: none

Defense Evasion
Persistence
  • Suspicious behavior: EnumeratesProcesses
    TableOfColors.exeTableOfColors.execiynbw.execiynbw.exeexplorer.exe

    Reported IOCs

    pidprocess
    1576TableOfColors.exe
    1440TableOfColors.exe
    1440TableOfColors.exe
    1604ciynbw.exe
    752ciynbw.exe
    752ciynbw.exe
    1644explorer.exe
    1644explorer.exe
  • Loads dropped DLL
    TableOfColors.exe

    Reported IOCs

    pidprocess
    1576TableOfColors.exe
    1576TableOfColors.exe
    1576TableOfColors.exe
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blacklisted process makes network request
    WScript.exe

    Reported IOCs

    flowpidprocess
    21860WScript.exe
  • Executes dropped EXE
    TableOfColors.exeTableOfColors.execiynbw.execiynbw.exe

    Reported IOCs

    pidprocess
    1576TableOfColors.exe
    1440TableOfColors.exe
    1604ciynbw.exe
    752ciynbw.exe
  • Suspicious use of WriteProcessMemory
    TableOfColors.execiynbw.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1576 wrote to memory of 14401576TableOfColors.exeTableOfColors.exe
    PID 1576 wrote to memory of 14401576TableOfColors.exeTableOfColors.exe
    PID 1576 wrote to memory of 14401576TableOfColors.exeTableOfColors.exe
    PID 1576 wrote to memory of 14401576TableOfColors.exeTableOfColors.exe
    PID 1576 wrote to memory of 16041576TableOfColors.execiynbw.exe
    PID 1576 wrote to memory of 16041576TableOfColors.execiynbw.exe
    PID 1576 wrote to memory of 16041576TableOfColors.execiynbw.exe
    PID 1576 wrote to memory of 16041576TableOfColors.execiynbw.exe
    PID 1576 wrote to memory of 3761576TableOfColors.exeschtasks.exe
    PID 1576 wrote to memory of 3761576TableOfColors.exeschtasks.exe
    PID 1576 wrote to memory of 3761576TableOfColors.exeschtasks.exe
    PID 1576 wrote to memory of 3761576TableOfColors.exeschtasks.exe
    PID 1604 wrote to memory of 7521604ciynbw.execiynbw.exe
    PID 1604 wrote to memory of 7521604ciynbw.execiynbw.exe
    PID 1604 wrote to memory of 7521604ciynbw.execiynbw.exe
    PID 1604 wrote to memory of 7521604ciynbw.execiynbw.exe
    PID 1604 wrote to memory of 16441604ciynbw.exeexplorer.exe
    PID 1604 wrote to memory of 16441604ciynbw.exeexplorer.exe
    PID 1604 wrote to memory of 16441604ciynbw.exeexplorer.exe
    PID 1604 wrote to memory of 16441604ciynbw.exeexplorer.exe
    PID 1604 wrote to memory of 16441604ciynbw.exeexplorer.exe
  • Suspicious behavior: MapViewOfSection
    ciynbw.exe

    Reported IOCs

    pidprocess
    1604ciynbw.exe
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    376schtasks.exe
  • Adds Run entry to start application
    explorer.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000\Software\Microsoft\Windows\CurrentVersion\Run\rrsrvzik = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Cyuujswhia\\ciynbw.exe\""explorer.exe
Processes 8
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MSG_986000.vbs"
    Blacklisted process makes network request
    PID:1860
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    PID:1980
  • C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe
    "C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe"
    Suspicious behavior: EnumeratesProcesses
    Loads dropped DLL
    Executes dropped EXE
    Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe
      C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe /C
      Suspicious behavior: EnumeratesProcesses
      Executes dropped EXE
      PID:1440
    • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe
      Suspicious behavior: EnumeratesProcesses
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      Suspicious behavior: MapViewOfSection
      PID:1604
      • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe /C
        Suspicious behavior: EnumeratesProcesses
        Executes dropped EXE
        PID:752
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Suspicious behavior: EnumeratesProcesses
        Adds Run entry to start application
        PID:1644
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn jtgbwgrid /tr "\"C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe\" /I jtgbwgrid" /SC ONCE /Z /ST 16:47 /ET 16:59
      Creates scheduled task(s)
      PID:376
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe

                      • C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe

                      • C:\Users\Admin\AppData\Local\Temp\TableOfColors.exe

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.dat

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe

                      • \Users\Admin\AppData\Local\Temp\TableOfColors.exe

                      • \Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe

                      • \Users\Admin\AppData\Roaming\Microsoft\Cyuujswhia\ciynbw.exe

                      • memory/752-11-0x0000000002370000-0x0000000002381000-memory.dmp

                      • memory/1440-5-0x0000000002220000-0x0000000002231000-memory.dmp

                      • memory/1604-12-0x0000000002220000-0x000000000225C000-memory.dmp

                      • memory/1860-0-0x0000000003870000-0x0000000003874000-memory.dmp