Overview

overview

10

Static

static

Darlehensv...20.vbs

windows7_x64

10

Darlehensv...20.vbs

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    20-05-2020 15:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Darlehensvertrag_237886470423_19052020.vbs

  • Size

    36.3MB

  • MD5

    a6eb9d904fc5eddda76ad4f9cf678e03

  • SHA1

    c370a3c9e108ae2452dfdedc91a2aa04634c7002

  • SHA256

    dfacae17a54e54e9b25d77399619859ed6b196318bd06341c22c7a8b4a090254

  • SHA512

    c00ac4ecaf2623ac4eb4d47191b3b0608d80bd3da552310652a2ccbc306b408f8c0d6d9e3f35208e2ad93b0c7a872ff8c055db7f2a3ecbb259ae639b55d780fb

Score
10/10
trojanbankerstealerqakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx123

Campaign

1589977350

C2

71.77.252.14:2222

174.130.225.61:443

76.187.97.98:2222

187.19.151.218:995

82.127.193.151:2222

72.204.242.138:993

72.204.242.138:993

66.208.105.6:443

24.183.39.93:443

98.243.187.85:443

68.49.120.179:443

72.204.242.138:995

72.29.181.77:2078

72.204.242.138:443

24.136.33.120:2222

96.56.237.174:990

107.2.148.99:443

216.201.162.158:443

71.213.29.14:995

84.247.55.190:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Blacklisted process makes network request 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Darlehensvertrag_237886470423_19052020.vbs"
    1⤵
    • Blacklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:272
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Loads dropped DLL
      PID:268
      • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1196
      • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:1140
        • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe /C
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1600
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1644
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dbfwkuui /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I dbfwkuui" /SC ONCE /Z /ST 17:18 /ET 17:30
        3⤵
        • Creates scheduled task(s)
        PID:608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.dat
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    Download Submit
  • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit
  • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    Download Submit
  • \Users\Admin\AppData\Roaming\Microsoft\Zzexu\ppajeu.exe
    Download Submit
  • memory/272-1-0x0000000002F10000-0x0000000002F14000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1140-12-0x0000000000300000-0x000000000033A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/1196-5-0x0000000002270000-0x0000000002281000-memory.dmp
    Filesize

    68KB

    Download
  • memory/1600-11-0x00000000024F0000-0x0000000002501000-memory.dmp
    Filesize

    68KB

    Download