Overview

overview

10

Static

static

c5481c0030...a3.dll

windows7_x64

10

c5481c0030...a3.dll

windows10_x64

10

Analysis

  • max time kernel
    91s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-01-2021 15:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll

  • Size

    2.2MB

  • MD5

    0c76d4790356edb9509662dd06825cc1

  • SHA1

    f69c9818651cae3757beaedaaf0681af2408fc89

  • SHA256

    c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3

  • SHA512

    2a233359c61a309898cd1162c80464adef18ed720da9203b839c0facc5cb5c6e3c7e89b7f900560ac231ff0ec8fae0046543bdcc26439dec1de3cdc4858d2fb3

Score
10/10
qakbotabc1171608747966bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qtgisprdw /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll\"" /SC ONCE /Z /ST 16:20 /ET 16:32
          4⤵
          • Creates scheduled task(s)
          PID:1616
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll"
      2⤵
      • Loads dropped DLL
      PID:420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll
    MD5

    aacf705be5ea3948b234aebc71c62e49

    SHA1

    f65b32454efb1b2575102a58860f713e9bfba880

    SHA256

    e679e356adec62f96cc459ec88ce8351c3a3103b7b80936fcd568a4c2ac6bc1c

    SHA512

    d4c7b606c9ee2ff65bb46c0913b5d23f0cefeb4f8007ede6fe1fd25e6de4447f20155ba63003583b1d74f9f0ed5f20096b780b25d869f14e7858c4e63a5314d6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\c5481c003005773954741e3fdd9cf0cc77d31fe59851321ddde80b41fe7ef0a3.dll
    MD5

    aacf705be5ea3948b234aebc71c62e49

    SHA1

    f65b32454efb1b2575102a58860f713e9bfba880

    SHA256

    e679e356adec62f96cc459ec88ce8351c3a3103b7b80936fcd568a4c2ac6bc1c

    SHA512

    d4c7b606c9ee2ff65bb46c0913b5d23f0cefeb4f8007ede6fe1fd25e6de4447f20155ba63003583b1d74f9f0ed5f20096b780b25d869f14e7858c4e63a5314d6

    Download Submit
  • memory/420-9-0x0000000000000000-mapping.dmp
    Download
  • memory/1176-11-0x0000000003250000-0x0000000003251000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1176-12-0x0000000003650000-0x0000000003651000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1252-2-0x0000000000000000-mapping.dmp
    Download
  • memory/1252-3-0x0000000004B10000-0x0000000004B44000-memory.dmp
    Filesize

    208KB

    Download
  • memory/1252-5-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

    Download
  • memory/1380-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1380-7-0x0000000003000000-0x0000000003034000-memory.dmp
    Filesize

    208KB

    Download
  • memory/1616-6-0x0000000000000000-mapping.dmp
    Download