Overview

overview

10

Static

static

Kaufvertra...20.vbs

windows7_x64

10

Kaufvertra...20.vbs

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    24-05-2020 14:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Kaufvertrag_335774592927_20052020.vbs

  • Size

    36.2MB

  • MD5

    e4c51a265a25b187d92ce90b381aff5f

  • SHA1

    b95bb9ca726d717703880c340f7a5c3c3f5e7bed

  • SHA256

    a468327ee5c173269fec06282bdc618a10f5770112147280fae282659d65ac44

  • SHA512

    de7ef4026401a3c371e58e3c40e63ed18adec9273a6c88e955eb32570e844f0b0cb640fd274eae0a485474f244ea1990cfd16bc47688e380a45015a81bc2e33c

Score
10/10
trojanbankerstealerqakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx124

Campaign

1590052330

C2

188.173.185.139:443

117.241.53.130:443

81.103.144.77:443

217.219.50.172:990

103.76.160.110:443

68.204.164.222:443

98.32.60.217:443

173.245.152.231:443

72.240.245.253:443

112.171.126.153:443

141.85.114.172:443

31.5.189.71:443

71.77.231.251:443

72.190.101.70:443

140.82.21.191:443

31.5.41.52:443

78.188.109.130:443

70.124.29.226:443

24.43.22.220:993

101.108.114.66:443

Signatures

  • Blacklisted process makes network request 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_335774592927_20052020.vbs"
    1⤵
    • Blacklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Loads dropped DLL
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:728
      • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:612
        • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe /C
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1588
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1624
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wjtnrjsnuq /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I wjtnrjsnuq" /SC ONCE /Z /ST 16:09 /ET 16:21
        3⤵
        • Creates scheduled task(s)
        PID:1672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.dat
    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
    Download Submit

  • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\Adsyoneeobk\rakuuc.exe
    Download Submit

  • memory/612-12-0x0000000001ED0000-0x0000000001F0A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/728-5-0x0000000002310000-0x0000000002321000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1016-1-0x0000000003010000-0x0000000003014000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1588-11-0x0000000002270000-0x0000000002281000-memory.dmp

    Filesize

    68KB

    Download