Analysis

  • max time kernel
    153s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    23-04-2021 19:36

General

  • Target

    f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll

  • Size

    793KB

  • MD5

    8656dfe70a79dd6513cdd5e9f5294d57

  • SHA1

    c7a846026a3f87a5b48c9316ae17e1888e7af5ed

  • SHA256

    f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897

  • SHA512

    83f4f85137aa8fb1a0a868c90db7906603536777956f8686dec952c93a9f10bcc994d21601c0ab67ec8e7c0abb0aa369fa43acb1b41fe18d5d0b3e71f57406bf

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

clinton08

Campaign

1618995832

C2

190.85.91.154:443

140.82.49.12:443

96.37.113.36:993

73.25.124.140:2222

71.41.184.10:3389

50.244.112.106:443

78.63.226.32:443

24.152.219.253:995

105.198.236.99:443

149.28.101.90:8443

149.28.101.90:443

149.28.101.90:2222

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

207.246.116.237:2222

45.77.117.108:995

144.202.38.185:2222

207.246.77.75:995

207.246.77.75:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c echo lake
        3⤵
          PID:2044
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cgpkzgwaf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll\"" /SC ONCE /Z /ST 21:35 /ET 21:47
            4⤵
            • Creates scheduled task(s)
            PID:1660
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {D7D6034F-6142-4CC0-A7E2-D9CE34B9459D} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\system32\regsvr32.exe
        regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Windows\SysWOW64\regsvr32.exe
          -s "C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll"
          3⤵
            PID:740

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll
        MD5

        4cae8d4665a7bcbb2864141f518f1048

        SHA1

        b5b54d97377752335b5750d9942b0d80e3908e20

        SHA256

        6bd5b2a598d5404ec0052d90de93253d2848775213ff76959c16c98fa4cae5b6

        SHA512

        21bf4198f0b763f7ddfd6ae920c8cf768d1875ec7f637a09919c99c07378d974d4d9d4420daffb586b5e5fd6bc72d2f781cf8dfb03895c6d4828b4a377815164

      • memory/740-74-0x0000000000000000-mapping.dmp
      • memory/1520-66-0x0000000000000000-mapping.dmp
      • memory/1520-69-0x0000000000080000-0x00000000000B9000-memory.dmp
        Filesize

        228KB

      • memory/1520-68-0x0000000074ED1000-0x0000000074ED3000-memory.dmp
        Filesize

        8KB

      • memory/1660-70-0x0000000000000000-mapping.dmp
      • memory/1716-71-0x0000000000000000-mapping.dmp
      • memory/1716-72-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp
        Filesize

        8KB

      • memory/2008-65-0x00000000001C0000-0x00000000001C1000-memory.dmp
        Filesize

        4KB

      • memory/2008-64-0x0000000075130000-0x000000007520C000-memory.dmp
        Filesize

        880KB

      • memory/2008-63-0x0000000075130000-0x0000000075169000-memory.dmp
        Filesize

        228KB

      • memory/2008-60-0x0000000000000000-mapping.dmp
      • memory/2008-61-0x0000000075B31000-0x0000000075B33000-memory.dmp
        Filesize

        8KB

      • memory/2044-62-0x0000000000000000-mapping.dmp