Analysis

  • max time kernel
    128s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    26-11-2020 15:11

General

  • Target

    a88f4c170e11eda9a789765001a84fb1.dll

  • Size

    271KB

  • MD5

    a88f4c170e11eda9a789765001a84fb1

  • SHA1

    b274da255232e48ab19e9b478f29ffd54f885a76

  • SHA256

    ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7

  • SHA512

    f5cd24cfd484d0ab54b7b0d0115005ab808d4bdde446380a2d2e9ab5a3f29265152e9139ba79fe8844be658afc7d41641ba71fa4f0fe050db4315d1055c3cf70

Malware Config

Extracted

Family

qakbot

Botnet

tr02

Campaign

1606301054

C2

59.98.96.143:443

86.122.248.164:2222

101.185.175.169:2222

71.187.170.235:443

92.59.35.196:2222

188.52.193.110:995

90.175.88.99:2222

37.107.111.46:995

96.237.141.134:995

2.50.143.154:2078

109.205.204.229:2222

90.101.62.189:2222

41.228.220.155:443

190.128.215.174:443

188.26.243.119:443

79.113.247.80:443

82.76.47.211:443

73.248.120.240:443

72.36.59.46:2222

74.129.26.119:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kpyxbxm /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll\"" /SC ONCE /Z /ST 15:16 /ET 15:28
          4⤵
          • Creates scheduled task(s)
          PID:1692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 340
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1536
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3D149E63-FD40-42E6-9928-1FA48B83794B} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll"
        3⤵
        • Loads dropped DLL
        PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll
    MD5

    6e67d0a0cdd1598fd466f301a841ad0d

    SHA1

    4f8b5efc49b138d0b624412107fa4ca6e356b754

    SHA256

    ae321153b31b5789658e43ece20dba63ab3c71fc8d233402b7165808aaee5f53

    SHA512

    28a775549848b738343fe182f3ab6dd5e283b4486adee12ad5c7a96bc321e6fdb8500d94533452599438a3f442505fc1a804df52f1a5242fdaf7c23521d5bfee

  • \Users\Admin\AppData\Local\Temp\a88f4c170e11eda9a789765001a84fb1.dll
    MD5

    6e67d0a0cdd1598fd466f301a841ad0d

    SHA1

    4f8b5efc49b138d0b624412107fa4ca6e356b754

    SHA256

    ae321153b31b5789658e43ece20dba63ab3c71fc8d233402b7165808aaee5f53

    SHA512

    28a775549848b738343fe182f3ab6dd5e283b4486adee12ad5c7a96bc321e6fdb8500d94533452599438a3f442505fc1a804df52f1a5242fdaf7c23521d5bfee

  • memory/748-12-0x0000000000000000-mapping.dmp
  • memory/1196-14-0x0000000000000000-mapping.dmp
  • memory/1212-8-0x0000000000000000-mapping.dmp
  • memory/1212-6-0x0000000000000000-mapping.dmp
  • memory/1212-7-0x0000000000000000-mapping.dmp
  • memory/1212-0-0x0000000000000000-mapping.dmp
  • memory/1212-2-0x0000000000AC0000-0x0000000000AE0000-memory.dmp
    Filesize

    128KB

  • memory/1536-5-0x00000000020C0000-0x00000000020D1000-memory.dmp
    Filesize

    68KB

  • memory/1536-9-0x0000000002830000-0x0000000002841000-memory.dmp
    Filesize

    68KB

  • memory/1536-4-0x0000000000000000-mapping.dmp
  • memory/1648-11-0x0000000000080000-0x00000000000A0000-memory.dmp
    Filesize

    128KB

  • memory/1648-3-0x0000000000000000-mapping.dmp
  • memory/1648-1-0x00000000000A0000-0x00000000000A2000-memory.dmp
    Filesize

    8KB

  • memory/1692-10-0x0000000000000000-mapping.dmp