Analysis

  • max time kernel
    150s
  • max time network
    91s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    04-02-2021 02:35

General

  • Target

    ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll

  • Size

    2.5MB

  • MD5

    66adf2e8e5561bf7cf3f3cb50d9256bf

  • SHA1

    4660be594b83147804564f04543e3ccc26dd44b9

  • SHA256

    ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777

  • SHA512

    c058776a73bc487e5c7f60b86c121ca2d1cdf19774639fe44232ce73cbf5cd91aa5b350dabcb8d6ba540f97db6f15843f6ec981ad2947bdf2d4a0b55b18f534f

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lhhxtiwknz /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll\"" /SC ONCE /Z /ST 03:34 /ET 03:46
          4⤵
          • Creates scheduled task(s)
          PID:1668
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E268FE0B-0821-400B-8FF0-169B730C8A8C} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll"
        3⤵
        • Loads dropped DLL
        PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll
    MD5

    356793f9e69b711141dafc547cb1b9ff

    SHA1

    982a84505a8eac5635e21fdcf4eebe866f7c0cf6

    SHA256

    739ff66a5ec2c8212cf44d50ac6605e4805b4f4754cab4b4e45a6f549b39c28b

    SHA512

    c0e0364b4210376a03f38112ff1f472ba1f3df4eb6f8596a0aa424358655e58251becd1250b36a63a2f4d721af18bc5476de656bfb3f8d2a0d928b3fbf18c9b4

  • \Users\Admin\AppData\Local\Temp\ca07735d51005cb63d1a5b6c213f6016e1d0fca26addbe8591f8acbf4147d777.dll
    MD5

    356793f9e69b711141dafc547cb1b9ff

    SHA1

    982a84505a8eac5635e21fdcf4eebe866f7c0cf6

    SHA256

    739ff66a5ec2c8212cf44d50ac6605e4805b4f4754cab4b4e45a6f549b39c28b

    SHA512

    c0e0364b4210376a03f38112ff1f472ba1f3df4eb6f8596a0aa424358655e58251becd1250b36a63a2f4d721af18bc5476de656bfb3f8d2a0d928b3fbf18c9b4

  • memory/1088-13-0x0000000000000000-mapping.dmp
  • memory/1088-14-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp
    Filesize

    8KB

  • memory/1204-16-0x0000000000000000-mapping.dmp
  • memory/1224-6-0x0000000000000000-mapping.dmp
  • memory/1224-8-0x0000000074A11000-0x0000000074A13000-memory.dmp
    Filesize

    8KB

  • memory/1224-10-0x00000000000C0000-0x00000000000F4000-memory.dmp
    Filesize

    208KB

  • memory/1224-12-0x00000000000C0000-0x00000000000F4000-memory.dmp
    Filesize

    208KB

  • memory/1668-11-0x0000000000000000-mapping.dmp
  • memory/2028-5-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

  • memory/2028-9-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

  • memory/2028-2-0x0000000000000000-mapping.dmp
  • memory/2028-4-0x0000000000C20000-0x0000000000E0A000-memory.dmp
    Filesize

    1.9MB

  • memory/2028-3-0x0000000075571000-0x0000000075573000-memory.dmp
    Filesize

    8KB