Overview

overview

10

Static

static

9

55555555555.dll

windows7_x64

10

55555555555.dll

windows10_x64

10

Analysis

  • max time kernel
    96s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25/12/2020, 22:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    55555555555.dll
  • Size 2.5MB
  • Sample201225-cpswhckh5j
  • SHA256 57cbd897236778fb796ee26f3e9a44b05c069d259f40348d2b839d006115ea61
  • MD5 SHA1 SHA512
Score
10/10
qakbotabc1171608747966bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Botnet

  • abc117

Campaign

  • 1608747966

C2

  • 67.6.54.180:443

  • 187.250.170.34:995

  • 67.141.11.98:443

  • 109.154.79.222:2222

  • 2.88.184.160:443

  • 85.52.72.32:2222

  • 86.98.21.234:443

  • 73.166.10.38:50003

  • 90.61.30.155:2222

  • 71.182.142.63:443

  • 178.223.22.192:995

  • 184.189.122.72:443

  • 181.39.236.199:443

  • 72.240.200.181:2222

  • 154.238.45.174:995

  • 47.22.148.6:443

  • 2.51.251.47:995

  • 199.19.117.131:443

  • 200.76.215.87:443

  • 37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 144 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\55555555555.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\55555555555.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn deojtosug /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\55555555555.dll\"" /SC ONCE /Z /ST 23:12 /ET 23:24
          4⤵
          • Creates scheduled task(s)
          PID:3948
  • C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3932
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\55555555555.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\55555555555.dll"
      2⤵
      • Loads dropped DLL
      PID:3128
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        PID:1560
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\55555555555.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\55555555555.dll"
      2⤵
      • Loads dropped DLL
      PID:4008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        PID:388

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/388-16-0x0000000003930000-0x0000000003931000-memory.dmp
        Download

        memory/1112-5-0x0000000010000000-0x0000000010034000-memory.dmp
        Download

        memory/1112-3-0x0000000000FB0000-0x0000000000FE4000-memory.dmp
        Download

        memory/1560-12-0x0000000003B00000-0x0000000003B01000-memory.dmp
        Download

        memory/3932-8-0x00007FFB84410000-0x00007FFB84DFC000-memory.dmp
        Download

        memory/3940-7-0x0000000003200000-0x0000000003234000-memory.dmp
        Download