Analysis

  • max time kernel
    144s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    25-03-2021 21:25

General

  • Target

    3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll

  • Size

    1.2MB

  • MD5

    460d1589846005f532ae3a5c92eb2353

  • SHA1

    1b12d99991db2c26edfe661db3bebb5db603e57f

  • SHA256

    3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816

  • SHA512

    03e578a834dc74e1079b9d6648ec080de5fbde7805035f648bdd05d87e6edfb80afdeef636cca0684386a9f0696131aad4aba4d6bd762588de168e8db6885757

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

C2

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ymroecreuu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll\"" /SC ONCE /Z /ST 21:31 /ET 21:43
          4⤵
          • Creates scheduled task(s)
          PID:1672
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {726F641B-3B8B-4891-A8F7-10CB47936A9E} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll"
        3⤵
        • Loads dropped DLL
        PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll
    MD5

    a07d884e034aa2c2fe160223996e8f84

    SHA1

    dad558864f30b906939e60fa7688aede7064fdb1

    SHA256

    3650aed32c00058136522f40105ed05aadbb0addda41354e846b022f41bf825f

    SHA512

    af61ddc24970cf829e710095bd723ee32cdc3e39269bd25d32511fcf0221e3d774f782ddafb7639560e535b3c47a2adb800945966bbb377cffcfdd65bd147d00

  • \Users\Admin\AppData\Local\Temp\3a9db32f8ffa83f1b5c9178f4ff2372b092e1aaac24dd74553e32317f114c816.dll
    MD5

    a07d884e034aa2c2fe160223996e8f84

    SHA1

    dad558864f30b906939e60fa7688aede7064fdb1

    SHA256

    3650aed32c00058136522f40105ed05aadbb0addda41354e846b022f41bf825f

    SHA512

    af61ddc24970cf829e710095bd723ee32cdc3e39269bd25d32511fcf0221e3d774f782ddafb7639560e535b3c47a2adb800945966bbb377cffcfdd65bd147d00

  • memory/684-9-0x0000000074841000-0x0000000074843000-memory.dmp
    Filesize

    8KB

  • memory/684-13-0x0000000000080000-0x00000000000BB000-memory.dmp
    Filesize

    236KB

  • memory/684-11-0x0000000000080000-0x00000000000BB000-memory.dmp
    Filesize

    236KB

  • memory/684-7-0x0000000000000000-mapping.dmp
  • memory/876-6-0x0000000000600000-0x000000000063B000-memory.dmp
    Filesize

    236KB

  • memory/876-10-0x0000000000600000-0x000000000063B000-memory.dmp
    Filesize

    236KB

  • memory/876-2-0x0000000000000000-mapping.dmp
  • memory/876-5-0x0000000000210000-0x0000000000249000-memory.dmp
    Filesize

    228KB

  • memory/876-4-0x0000000000120000-0x0000000000121000-memory.dmp
    Filesize

    4KB

  • memory/876-3-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
    Filesize

    8KB

  • memory/980-14-0x0000000000000000-mapping.dmp
  • memory/980-15-0x000007FEFC021000-0x000007FEFC023000-memory.dmp
    Filesize

    8KB

  • memory/1544-17-0x0000000000000000-mapping.dmp
  • memory/1672-12-0x0000000000000000-mapping.dmp