Kaufvertrag_335774592927_20052020.vbs

General
Target

Kaufvertrag_335774592927_20052020.vbs

Filesize

36MB

Completed

24-05-2020 14:08

Score
10 /10
MD5

e4c51a265a25b187d92ce90b381aff5f

SHA1

b95bb9ca726d717703880c340f7a5c3c3f5e7bed

SHA256

a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

Malware Config

Extracted

Family qakbot
Botnet spx124
Campaign 1590052330
C2

188.173.185.139:443

117.241.53.130:443

81.103.144.77:443

217.219.50.172:990

103.76.160.110:443

68.204.164.222:443

98.32.60.217:443

173.245.152.231:443

72.240.245.253:443

112.171.126.153:443

141.85.114.172:443

31.5.189.71:443

71.77.231.251:443

72.190.101.70:443

140.82.21.191:443

31.5.41.52:443

78.188.109.130:443

70.124.29.226:443

24.43.22.220:993

101.108.114.66:443

137.103.143.124:443

203.213.104.25:995

182.56.134.44:995

24.201.79.208:2078

24.110.96.149:443

98.222.23.221:443

50.104.186.71:443

67.83.54.76:2222

104.36.135.227:443

68.1.171.93:443

24.43.22.220:995

75.183.171.155:3389

47.41.3.40:443

68.98.142.248:995

81.133.234.36:2222

98.121.187.78:443

47.205.231.60:443

66.26.160.37:443

69.92.54.95:995

67.209.195.198:3389

41.228.231.93:443

184.98.104.7:995

72.204.242.138:6881

210.61.141.92:443

35.142.12.163:2222

24.46.40.189:2222

96.56.237.174:993

189.231.179.154:443

98.115.138.61:443

50.29.166.232:995

Signatures 8

Filter: none

Persistence
  • Blacklisted process makes network request
    WScript.exe

    Reported IOCs

    flowpidprocess
    31016WScript.exe
  • Suspicious use of WriteProcessMemory
    WScript.exePicturesViewer.exerakuuc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1016 wrote to memory of 6481016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 6481016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 6481016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 6481016WScript.exePicturesViewer.exe
    PID 648 wrote to memory of 728648PicturesViewer.exePicturesViewer.exe
    PID 648 wrote to memory of 728648PicturesViewer.exePicturesViewer.exe
    PID 648 wrote to memory of 728648PicturesViewer.exePicturesViewer.exe
    PID 648 wrote to memory of 728648PicturesViewer.exePicturesViewer.exe
    PID 648 wrote to memory of 612648PicturesViewer.exerakuuc.exe
    PID 648 wrote to memory of 612648PicturesViewer.exerakuuc.exe
    PID 648 wrote to memory of 612648PicturesViewer.exerakuuc.exe
    PID 648 wrote to memory of 612648PicturesViewer.exerakuuc.exe
    PID 648 wrote to memory of 1672648PicturesViewer.exeschtasks.exe
    PID 648 wrote to memory of 1672648PicturesViewer.exeschtasks.exe
    PID 648 wrote to memory of 1672648PicturesViewer.exeschtasks.exe
    PID 648 wrote to memory of 1672648PicturesViewer.exeschtasks.exe
    PID 612 wrote to memory of 1588612rakuuc.exerakuuc.exe
    PID 612 wrote to memory of 1588612rakuuc.exerakuuc.exe
    PID 612 wrote to memory of 1588612rakuuc.exerakuuc.exe
    PID 612 wrote to memory of 1588612rakuuc.exerakuuc.exe
    PID 612 wrote to memory of 1624612rakuuc.exeexplorer.exe
    PID 612 wrote to memory of 1624612rakuuc.exeexplorer.exe
    PID 612 wrote to memory of 1624612rakuuc.exeexplorer.exe
    PID 612 wrote to memory of 1624612rakuuc.exeexplorer.exe
    PID 612 wrote to memory of 1624612rakuuc.exeexplorer.exe
  • Executes dropped EXE
    PicturesViewer.exePicturesViewer.exerakuuc.exerakuuc.exe

    Reported IOCs

    pidprocess
    648PicturesViewer.exe
    728PicturesViewer.exe
    612rakuuc.exe
    1588rakuuc.exe
  • Suspicious behavior: EnumeratesProcesses
    PicturesViewer.exePicturesViewer.exerakuuc.exerakuuc.exeexplorer.exe

    Reported IOCs

    pidprocess
    648PicturesViewer.exe
    728PicturesViewer.exe
    728PicturesViewer.exe
    612rakuuc.exe
    1588rakuuc.exe
    1588rakuuc.exe
    1624explorer.exe
    1624explorer.exe
  • Loads dropped DLL
    PicturesViewer.exe

    Reported IOCs

    pidprocess
    648PicturesViewer.exe
    648PicturesViewer.exe
    648PicturesViewer.exe
  • Suspicious behavior: MapViewOfSection
    rakuuc.exe

    Reported IOCs

    pidprocess
    612rakuuc.exe
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1672schtasks.exe
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

Processes 7
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_335774592927_20052020.vbs"
    Blacklisted process makes network request
    Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      Suspicious use of WriteProcessMemory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Loads dropped DLL
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:728
      • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
        Suspicious use of WriteProcessMemory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        PID:612
        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe /C
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          PID:1588
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          Suspicious behavior: EnumeratesProcesses
          PID:1624
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wjtnrjsnuq /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I wjtnrjsnuq" /SC ONCE /Z /ST 16:09 /ET 16:21
        Creates scheduled task(s)
        PID:1672
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.dat

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

                        • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                        • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

                        • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe

                        • memory/612-12-0x0000000001ED0000-0x0000000001F0A000-memory.dmp

                        • memory/728-5-0x0000000002310000-0x0000000002321000-memory.dmp

                        • memory/1016-1-0x0000000003010000-0x0000000003014000-memory.dmp

                        • memory/1588-11-0x0000000002270000-0x0000000002281000-memory.dmp