Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-04-2021 19:36

General

  • Target

    f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll

  • Size

    793KB

  • MD5

    8656dfe70a79dd6513cdd5e9f5294d57

  • SHA1

    c7a846026a3f87a5b48c9316ae17e1888e7af5ed

  • SHA256

    f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897

  • SHA512

    83f4f85137aa8fb1a0a868c90db7906603536777956f8686dec952c93a9f10bcc994d21601c0ab67ec8e7c0abb0aa369fa43acb1b41fe18d5d0b3e71f57406bf

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

clinton08

Campaign

1618995832

C2

190.85.91.154:443

140.82.49.12:443

96.37.113.36:993

73.25.124.140:2222

71.41.184.10:3389

50.244.112.106:443

78.63.226.32:443

24.152.219.253:995

105.198.236.99:443

149.28.101.90:8443

149.28.101.90:443

149.28.101.90:2222

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:2222

207.246.116.237:2222

45.77.117.108:995

144.202.38.185:2222

207.246.77.75:995

207.246.77.75:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c echo lake
        3⤵
          PID:3336
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bpoilewjj /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll\"" /SC ONCE /Z /ST 21:35 /ET 21:47
            4⤵
            • Creates scheduled task(s)
            PID:900
    • \??\c:\windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll"
        2⤵
        • Loads dropped DLL
        PID:1408

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll
      MD5

      4cae8d4665a7bcbb2864141f518f1048

      SHA1

      b5b54d97377752335b5750d9942b0d80e3908e20

      SHA256

      6bd5b2a598d5404ec0052d90de93253d2848775213ff76959c16c98fa4cae5b6

      SHA512

      21bf4198f0b763f7ddfd6ae920c8cf768d1875ec7f637a09919c99c07378d974d4d9d4420daffb586b5e5fd6bc72d2f781cf8dfb03895c6d4828b4a377815164

    • \Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll
      MD5

      4cae8d4665a7bcbb2864141f518f1048

      SHA1

      b5b54d97377752335b5750d9942b0d80e3908e20

      SHA256

      6bd5b2a598d5404ec0052d90de93253d2848775213ff76959c16c98fa4cae5b6

      SHA512

      21bf4198f0b763f7ddfd6ae920c8cf768d1875ec7f637a09919c99c07378d974d4d9d4420daffb586b5e5fd6bc72d2f781cf8dfb03895c6d4828b4a377815164

    • \Users\Admin\AppData\Local\Temp\f47d4cc0fd011a1f8a74ced31d693742378f2ccb6b3d0b6b8d322cd31e62f897.dll
      MD5

      4cae8d4665a7bcbb2864141f518f1048

      SHA1

      b5b54d97377752335b5750d9942b0d80e3908e20

      SHA256

      6bd5b2a598d5404ec0052d90de93253d2848775213ff76959c16c98fa4cae5b6

      SHA512

      21bf4198f0b763f7ddfd6ae920c8cf768d1875ec7f637a09919c99c07378d974d4d9d4420daffb586b5e5fd6bc72d2f781cf8dfb03895c6d4828b4a377815164

    • memory/900-120-0x0000000000000000-mapping.dmp
    • memory/1220-114-0x0000000000000000-mapping.dmp
    • memory/1220-116-0x0000000074390000-0x00000000743C9000-memory.dmp
      Filesize

      228KB

    • memory/1220-117-0x0000000074390000-0x000000007446C000-memory.dmp
      Filesize

      880KB

    • memory/1220-118-0x0000000002760000-0x0000000002761000-memory.dmp
      Filesize

      4KB

    • memory/1408-125-0x0000000000000000-mapping.dmp
    • memory/3336-115-0x0000000000000000-mapping.dmp
    • memory/4016-119-0x0000000000000000-mapping.dmp
    • memory/4016-123-0x0000000000520000-0x0000000000559000-memory.dmp
      Filesize

      228KB