Analysis

  • max time kernel
    133s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-03-2021 20:17

General

  • Target

    svvhos.dati2.dll

  • Size

    770KB

  • MD5

    4763f1ab776ad1946794b92147fc8812

  • SHA1

    9760c3de159869c976b70be5bcc05465ef9a8d58

  • SHA256

    9dfeb3b1c79a2de9a175b2eeae77116839e783ef19c0acb9fc21b72eb5669b4d

  • SHA512

    914014a210bf4e471aa15c6b66d81a203290e201cedf86b9f3794c94b8770c4c6cfa64a9c4526a7ec86ebee8701bc12a02ba054549f233d0c45532040f5150f8

Malware Config

Extracted

Family

qakbot

Botnet

obama10

Campaign

1615286191

C2

76.94.200.148:995

140.82.49.12:443

24.95.61.62:443

195.43.173.70:443

197.45.110.165:995

87.202.87.210:2222

79.115.174.55:443

196.151.252.84:443

45.118.216.157:443

77.211.30.202:995

89.3.198.238:443

47.196.192.184:443

86.175.79.249:443

80.227.5.69:443

70.168.130.172:995

83.110.108.38:2222

71.117.132.169:443

184.189.122.72:443

47.22.148.6:443

84.72.35.226:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dkcjzgpgne /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll\"" /SC ONCE /Z /ST 21:16 /ET 21:28
          4⤵
          • Creates scheduled task(s)
          PID:736
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {5B7FE2E1-3974-4F1C-8EDE-80B93E68C514} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll"
        3⤵
        • Loads dropped DLL
        PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svvhos.dati2.dll
    MD5

    6313521cd69542e749274b7b00b1e3ed

    SHA1

    49f74f00a9625f8a76d0e92e58a9390cccc12bcb

    SHA256

    a6146668a9a075ea11d3f21aa3b5f4d85443883421770fd92f80b9a0a9b71ad8

    SHA512

    87b4275bcbfdcf140cc830b66740b11f5ad44e7684c3d16e6a1fa900481310e4d8504621299e5f6c37dd547e294bfdb73be5594ef62105b27937a3da4c44102a

  • \Users\Admin\AppData\Local\Temp\svvhos.dati2.dll
    MD5

    6313521cd69542e749274b7b00b1e3ed

    SHA1

    49f74f00a9625f8a76d0e92e58a9390cccc12bcb

    SHA256

    a6146668a9a075ea11d3f21aa3b5f4d85443883421770fd92f80b9a0a9b71ad8

    SHA512

    87b4275bcbfdcf140cc830b66740b11f5ad44e7684c3d16e6a1fa900481310e4d8504621299e5f6c37dd547e294bfdb73be5594ef62105b27937a3da4c44102a

  • memory/736-12-0x0000000000000000-mapping.dmp
  • memory/1252-3-0x0000000076191000-0x0000000076193000-memory.dmp
    Filesize

    8KB

  • memory/1252-4-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

  • memory/1252-6-0x00000000003A0000-0x00000000003D5000-memory.dmp
    Filesize

    212KB

  • memory/1252-5-0x0000000000320000-0x0000000000353000-memory.dmp
    Filesize

    204KB

  • memory/1252-10-0x00000000003A0000-0x00000000003D5000-memory.dmp
    Filesize

    212KB

  • memory/1252-2-0x0000000000000000-mapping.dmp
  • memory/1684-15-0x000007FEFC011000-0x000007FEFC013000-memory.dmp
    Filesize

    8KB

  • memory/1684-14-0x0000000000000000-mapping.dmp
  • memory/1772-13-0x0000000000160000-0x0000000000195000-memory.dmp
    Filesize

    212KB

  • memory/1772-11-0x0000000000160000-0x0000000000195000-memory.dmp
    Filesize

    212KB

  • memory/1772-9-0x0000000074B41000-0x0000000074B43000-memory.dmp
    Filesize

    8KB

  • memory/1772-7-0x0000000000000000-mapping.dmp
  • memory/2044-17-0x0000000000000000-mapping.dmp