Analysis

  • max time kernel
    137s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-02-2021 08:05

General

  • Target

    2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll

  • Size

    361KB

  • MD5

    bde20def51b896d6b12344760571b9b8

  • SHA1

    409e17fe79aac777d8176dd9002ee3b78fd9c37e

  • SHA256

    2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652

  • SHA512

    6f599f5beb601a5f6fc9b7dd57324ecc9776f6c9c098913f5598e66ba8fc9a9c390ba74ba3ced127b3bc89192aa2fd948a948e0d15617b429a1dba2f6de80782

Malware Config

Extracted

Family

qakbot

Botnet

abc124

Campaign

1612362406

C2

86.236.77.68:2222

64.121.114.87:443

172.87.134.226:995

82.12.157.95:995

160.3.187.114:443

78.97.207.104:443

69.123.179.70:443

197.161.154.132:443

50.244.112.106:443

83.110.108.181:2222

105.198.236.99:443

74.77.162.33:443

196.151.252.84:443

140.82.49.12:443

45.118.216.157:443

80.11.173.82:8443

86.216.208.38:2222

72.240.200.181:2222

222.154.253.111:995

68.186.192.69:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll,#1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3880
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gysbsyidr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll\"" /SC ONCE /Z /ST 08:11 /ET 08:23
          4⤵
          • Creates scheduled task(s)
          PID:3984
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3524
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll"
      2⤵
      • Loads dropped DLL
      PID:3532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3848

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll
    MD5

    96506b8fa54e0bf482114715e7cb0779

    SHA1

    dfd1ec5cddf57adc00120b4f051357a9a3c5e2bc

    SHA256

    96f79a76225ccc2913e16329b19eb23b115d4d7883c8ade450ab850515635d22

    SHA512

    a6c14565bfb7eebf07ad19ed2209de1665b90e517c4128897b3aa7fc26a7f68b07245dc47c2e43c2444cb6499aef8cdd6511f9a104f91d635d413e6322bfe8c9

  • \Users\Admin\AppData\Local\Temp\2d2f68bcb9584a9e2c32ef1dd47eb5d670104882100b9af6c759056a03464652.dll
    MD5

    96506b8fa54e0bf482114715e7cb0779

    SHA1

    dfd1ec5cddf57adc00120b4f051357a9a3c5e2bc

    SHA256

    96f79a76225ccc2913e16329b19eb23b115d4d7883c8ade450ab850515635d22

    SHA512

    a6c14565bfb7eebf07ad19ed2209de1665b90e517c4128897b3aa7fc26a7f68b07245dc47c2e43c2444cb6499aef8cdd6511f9a104f91d635d413e6322bfe8c9

  • memory/3532-10-0x0000000000000000-mapping.dmp
  • memory/3848-14-0x0000000003090000-0x0000000003091000-memory.dmp
    Filesize

    4KB

  • memory/3848-13-0x0000000003090000-0x0000000003091000-memory.dmp
    Filesize

    4KB

  • memory/3848-12-0x0000000003090000-0x0000000003091000-memory.dmp
    Filesize

    4KB

  • memory/3880-5-0x0000000000000000-mapping.dmp
  • memory/3880-8-0x0000000000ED0000-0x0000000000F05000-memory.dmp
    Filesize

    212KB

  • memory/3880-7-0x0000000000ED0000-0x0000000000F05000-memory.dmp
    Filesize

    212KB

  • memory/3984-6-0x0000000000000000-mapping.dmp
  • memory/4760-2-0x0000000000000000-mapping.dmp
  • memory/4760-4-0x0000000010000000-0x0000000012552000-memory.dmp
    Filesize

    37.3MB

  • memory/4760-3-0x0000000004480000-0x00000000069D2000-memory.dmp
    Filesize

    37.3MB