5932c8742b819a8112fabdc0b9db1811

General
Target

Darlehensvertrag_237886470423_19052020.vbs

Filesize

36MB

Completed

20-05-2020 15:17

Score
10 /10
MD5

a6eb9d904fc5eddda76ad4f9cf678e03

SHA1

c370a3c9e108ae2452dfdedc91a2aa04634c7002

SHA256

dfacae17a54e54e9b25d77399619859ed6b196318bd06341c22c7a8b4a090254

Malware Config

Extracted

Family qakbot
Botnet spx123
Campaign 1589977350
C2

71.77.252.14:2222

174.130.225.61:443

76.187.97.98:2222

187.19.151.218:995

82.127.193.151:2222

72.204.242.138:993

72.204.242.138:993

66.208.105.6:443

24.183.39.93:443

98.243.187.85:443

68.49.120.179:443

72.204.242.138:995

72.29.181.77:2078

72.204.242.138:443

24.136.33.120:2222

96.56.237.174:990

107.2.148.99:443

216.201.162.158:443

71.213.29.14:995

84.247.55.190:443

86.124.2.219:443

189.236.29.119:443

199.116.241.147:443

79.115.20.123:443

67.170.137.8:443

200.113.201.83:993

100.12.173.247:995

82.210.157.185:443

79.78.131.124:443

186.94.179.27:2078

102.41.121.242:995

24.202.42.48:2222

208.93.202.49:443

72.16.212.108:465

98.118.156.172:443

31.125.140.150:2222

5.36.67.194:443

108.30.125.94:443

190.130.235.79:443

151.205.102.42:443

68.39.160.40:443

68.204.164.222:443

108.54.205.207:443

47.203.89.185:443

79.114.195.15:443

174.34.67.106:2222

73.214.231.2:443

96.18.240.158:443

156.222.43.142:995

178.27.203.107:443

Signatures 8

Filter: none

Persistence
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    608schtasks.exe
  • Blacklisted process makes network request
    WScript.exe

    Reported IOCs

    flowpidprocess
    4272WScript.exe
  • Suspicious use of WriteProcessMemory
    WScript.exePicturesViewer.exeppajeu.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 272 wrote to memory of 268272WScript.exePicturesViewer.exe
    PID 272 wrote to memory of 268272WScript.exePicturesViewer.exe
    PID 272 wrote to memory of 268272WScript.exePicturesViewer.exe
    PID 272 wrote to memory of 268272WScript.exePicturesViewer.exe
    PID 268 wrote to memory of 1196268PicturesViewer.exePicturesViewer.exe
    PID 268 wrote to memory of 1196268PicturesViewer.exePicturesViewer.exe
    PID 268 wrote to memory of 1196268PicturesViewer.exePicturesViewer.exe
    PID 268 wrote to memory of 1196268PicturesViewer.exePicturesViewer.exe
    PID 268 wrote to memory of 1140268PicturesViewer.exeppajeu.exe
    PID 268 wrote to memory of 1140268PicturesViewer.exeppajeu.exe
    PID 268 wrote to memory of 1140268PicturesViewer.exeppajeu.exe
    PID 268 wrote to memory of 1140268PicturesViewer.exeppajeu.exe
    PID 268 wrote to memory of 608268PicturesViewer.exeschtasks.exe
    PID 268 wrote to memory of 608268PicturesViewer.exeschtasks.exe
    PID 268 wrote to memory of 608268PicturesViewer.exeschtasks.exe
    PID 268 wrote to memory of 608268PicturesViewer.exeschtasks.exe
    PID 1140 wrote to memory of 16001140ppajeu.exeppajeu.exe
    PID 1140 wrote to memory of 16001140ppajeu.exeppajeu.exe
    PID 1140 wrote to memory of 16001140ppajeu.exeppajeu.exe
    PID 1140 wrote to memory of 16001140ppajeu.exeppajeu.exe
    PID 1140 wrote to memory of 16441140ppajeu.exeexplorer.exe
    PID 1140 wrote to memory of 16441140ppajeu.exeexplorer.exe
    PID 1140 wrote to memory of 16441140ppajeu.exeexplorer.exe
    PID 1140 wrote to memory of 16441140ppajeu.exeexplorer.exe
    PID 1140 wrote to memory of 16441140ppajeu.exeexplorer.exe
  • Executes dropped EXE
    PicturesViewer.exePicturesViewer.exeppajeu.exeppajeu.exe

    Reported IOCs

    pidprocess
    268PicturesViewer.exe
    1196PicturesViewer.exe
    1140ppajeu.exe
    1600ppajeu.exe
  • Suspicious behavior: EnumeratesProcesses
    PicturesViewer.exePicturesViewer.exeppajeu.exeppajeu.exeexplorer.exe

    Reported IOCs

    pidprocess
    268PicturesViewer.exe
    1196PicturesViewer.exe
    1196PicturesViewer.exe
    1140ppajeu.exe
    1600ppajeu.exe
    1600ppajeu.exe
    1644explorer.exe
    1644explorer.exe
  • Loads dropped DLL
    PicturesViewer.exe

    Reported IOCs

    pidprocess
    268PicturesViewer.exe
    268PicturesViewer.exe
    268PicturesViewer.exe
  • Suspicious behavior: MapViewOfSection
    ppajeu.exe

    Reported IOCs

    pidprocess
    1140ppajeu.exe
Processes 7
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Darlehensvertrag_237886470423_19052020.vbs"
    Blacklisted process makes network request
    Suspicious use of WriteProcessMemory
    PID:272
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      Suspicious use of WriteProcessMemory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Loads dropped DLL
      PID:268
      • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:1196
      • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
        Suspicious use of WriteProcessMemory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        PID:1140
        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe /C
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          PID:1600
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          Suspicious behavior: EnumeratesProcesses
          PID:1644
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dbfwkuui /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I dbfwkuui" /SC ONCE /Z /ST 17:18 /ET 17:30
        Creates scheduled task(s)
        PID:608
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.dat

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

                        • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

                        • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe

                        • memory/272-1-0x0000000002F10000-0x0000000002F14000-memory.dmp

                        • memory/1140-12-0x0000000000300000-0x000000000033A000-memory.dmp

                        • memory/1196-5-0x0000000002270000-0x0000000002281000-memory.dmp

                        • memory/1600-11-0x00000000024F0000-0x0000000002501000-memory.dmp