Analysis
- max time kernel
132s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
02/12/2020, 17:39
General
- Target f25f91576f25f4ece9e48b634db28991.dll
- Size 293KB
- Sample201202-rnjhc8qt8x
- SHA256 e14001eb97b6f5650df3edc7270e00d4bc5f015fc0424b00d38e0a54d6ca08cb
Malware Config
Extracted
-
qakbot
-
tr02
-
1606748059
-
197.45.110.165:995
-
86.99.134.235:2222
-
174.76.21.134:443
-
208.99.100.129:443
-
86.126.198.195:443
-
185.105.131.233:443
-
85.132.36.111:2222
-
105.198.236.101:443
-
2.49.219.254:22
-
217.165.2.92:995
-
67.6.54.180:443
-
5.193.115.251:2222
-
83.196.50.197:2222
-
89.3.198.238:443
-
94.141.3.242:443
-
73.239.229.107:995
-
217.165.15.245:2222
-
68.225.60.77:995
-
85.121.42.12:443
-
99.240.226.2:443
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Loads dropped DLL 1 IoCs
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f25f91576f25f4ece9e48b634db28991.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f25f91576f25f4ece9e48b634db28991.dll2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lifdruwmii /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f25f91576f25f4ece9e48b634db28991.dll\"" /SC ONCE /Z /ST 18:44 /ET 18:564⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 7603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f25f91576f25f4ece9e48b634db28991.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\f25f91576f25f4ece9e48b634db28991.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1740-3-0x0000000003350000-0x0000000003370000-memory.dmp
memory/2724-62-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-56-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-29-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-19-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2724-20-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2724-21-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2724-31-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-24-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-25-0x00000000037D0000-0x00000000037D1000-memory.dmp
memory/2724-27-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-28-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-30-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-33-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-36-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-41-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-46-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-53-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-32-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-61-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-60-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-59-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-58-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-57-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-34-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-55-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-54-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-52-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-51-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-50-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-49-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-48-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-47-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-45-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-44-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-43-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-42-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-40-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-39-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-38-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-37-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2724-35-0x0000000003440000-0x0000000003441000-memory.dmp
memory/2916-6-0x00000000006F0000-0x0000000000710000-memory.dmp
memory/4072-7-0x0000000004480000-0x0000000004481000-memory.dmp
memory/4072-11-0x00000000049B0000-0x00000000049B1000-memory.dmp