Analysis

  • max time kernel
    135s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03-02-2021 14:33

General

  • Target

    541310.jpg.dll

  • Size

    298KB

  • MD5

    3f5a4fa521fb40c5d70f39951f261605

  • SHA1

    ad4d9008562e2c2097d96ba3314d7d450734f4df

  • SHA256

    c0f3d4a44486b91a5cb4911608f036ce303b3020aa90cbe5d79c35bc84e1ad5b

  • SHA512

    303eb8d997054fc5de2979ead9006ffe2047cb60c10caddc0fbd4a8f37700f723bb41cc75d0479a09cfe66f1be31cc835cbb805beab01e07c57707a9e76b02bc

Malware Config

Extracted

Family

qakbot

Botnet

abc123

Campaign

1612349986

C2

222.154.253.111:995

50.244.112.106:443

83.110.108.181:2222

105.198.236.99:443

74.77.162.33:443

106.250.150.98:443

196.151.252.84:443

45.118.216.157:443

140.82.49.12:443

80.11.173.82:8443

71.88.193.17:443

68.186.192.69:443

46.153.119.255:995

81.214.126.173:2222

108.31.15.10:995

197.45.110.165:995

81.88.254.62:443

86.97.8.249:443

202.187.58.21:443

41.39.134.183:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:416
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll,#1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:360
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qxeesvyl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll\"" /SC ONCE /Z /ST 15:40 /ET 15:52
          4⤵
          • Creates scheduled task(s)
          PID:3912
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll"
      2⤵
      • Loads dropped DLL
      PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\541310.jpg.dll
    MD5

    00945ed7b49005a15b961272ecd4b82d

    SHA1

    d5e3d8ef54c8fba6aa82bbddb6f522582d39e477

    SHA256

    6e34285a28427891d8bf9631774215bdfadbe197d5df231293ab5595c8b82605

    SHA512

    87d22ea51be3ab2444b8c64add58ecff1da3c5322e46af81c8785034abd4f1e02c4a28c90454b2e326e58a4f920c3fa6f06059e48b75a121e30331370ec1034c

  • \Users\Admin\AppData\Local\Temp\541310.jpg.dll
    MD5

    00945ed7b49005a15b961272ecd4b82d

    SHA1

    d5e3d8ef54c8fba6aa82bbddb6f522582d39e477

    SHA256

    6e34285a28427891d8bf9631774215bdfadbe197d5df231293ab5595c8b82605

    SHA512

    87d22ea51be3ab2444b8c64add58ecff1da3c5322e46af81c8785034abd4f1e02c4a28c90454b2e326e58a4f920c3fa6f06059e48b75a121e30331370ec1034c

  • \Users\Admin\AppData\Local\Temp\541310.jpg.dll
    MD5

    00945ed7b49005a15b961272ecd4b82d

    SHA1

    d5e3d8ef54c8fba6aa82bbddb6f522582d39e477

    SHA256

    6e34285a28427891d8bf9631774215bdfadbe197d5df231293ab5595c8b82605

    SHA512

    87d22ea51be3ab2444b8c64add58ecff1da3c5322e46af81c8785034abd4f1e02c4a28c90454b2e326e58a4f920c3fa6f06059e48b75a121e30331370ec1034c

  • memory/360-2-0x0000000000000000-mapping.dmp
  • memory/360-4-0x0000000000400000-0x0000000000435000-memory.dmp
    Filesize

    212KB

  • memory/360-3-0x0000000003510000-0x0000000003544000-memory.dmp
    Filesize

    208KB

  • memory/748-5-0x0000000000000000-mapping.dmp
  • memory/748-7-0x0000000000EA0000-0x0000000000ED5000-memory.dmp
    Filesize

    212KB

  • memory/748-8-0x0000000000EA0000-0x0000000000ED5000-memory.dmp
    Filesize

    212KB

  • memory/1312-10-0x0000000000000000-mapping.dmp
  • memory/3912-6-0x0000000000000000-mapping.dmp