Analysis

  • max time kernel
    128s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    28-04-2021 21:07

General

  • Target

    file.dll

  • Size

    400KB

  • MD5

    b0813ebd96b1024463c8cc508ef9ce83

  • SHA1

    a78702f9ed4f4e4c516fc6c836e6274fa668278b

  • SHA256

    1dd94ada0e05a01a8b20db32924c6a5d2a3891b7ebf33f2ffbbed0b1a044734b

  • SHA512

    a7ba5f877e973732f8f9e23ea65c8887937e93957a907051cd9e4be5a43683ed2d82ee4684abc35ad4edd4afdcca0922af77447c7a43fbc77aabb57571e81ffe

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden02

Campaign

1614154620

C2

98.173.34.213:995

160.3.187.114:443

73.25.124.140:2222

24.50.118.93:443

82.127.125.209:990

83.110.109.106:2222

79.129.121.81:995

189.223.234.23:995

125.63.101.62:443

113.22.175.141:443

172.78.30.215:443

47.146.169.85:443

47.22.148.6:443

76.25.142.196:443

78.63.226.32:443

105.198.236.101:443

75.67.192.125:443

176.181.247.197:443

105.96.8.96:443

108.31.15.10:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\file.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kvagbta /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\file.dll\"" /SC ONCE /Z /ST 21:06 /ET 21:18
          4⤵
          • Creates scheduled task(s)
          PID:1132
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {82959FCF-87EC-45D2-9994-396FFE7CF951} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1192
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\file.dll"
        3⤵
        • Loads dropped DLL
        PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\file.dll
    MD5

    40bc5f6a77f2d838b23ac90c54c84a92

    SHA1

    e1c33603246fa0d30c40503675c1914d5d727104

    SHA256

    7c7c75ff0249af021f9746b0966416ec826dbde7a25f2be3646cefb7113a9619

    SHA512

    4a470c905dd465e93a1ba9d3f2faca75bb57be1767fcc3d84f0caaa0617a27ee47984a32d137c82d8b343efce5310498a42d2901ed47f328c02f369d640249c1

  • \Users\Admin\AppData\Local\Temp\file.dll
    MD5

    40bc5f6a77f2d838b23ac90c54c84a92

    SHA1

    e1c33603246fa0d30c40503675c1914d5d727104

    SHA256

    7c7c75ff0249af021f9746b0966416ec826dbde7a25f2be3646cefb7113a9619

    SHA512

    4a470c905dd465e93a1ba9d3f2faca75bb57be1767fcc3d84f0caaa0617a27ee47984a32d137c82d8b343efce5310498a42d2901ed47f328c02f369d640249c1

  • memory/452-60-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp
    Filesize

    8KB

  • memory/852-73-0x0000000000000000-mapping.dmp
  • memory/1132-68-0x0000000000000000-mapping.dmp
  • memory/1192-70-0x0000000000000000-mapping.dmp
  • memory/1456-64-0x0000000010000000-0x0000000010066000-memory.dmp
    Filesize

    408KB

  • memory/1456-61-0x0000000000000000-mapping.dmp
  • memory/1456-63-0x0000000000430000-0x00000000004B0000-memory.dmp
    Filesize

    512KB

  • memory/1456-62-0x00000000753E1000-0x00000000753E3000-memory.dmp
    Filesize

    8KB

  • memory/1528-67-0x0000000074861000-0x0000000074863000-memory.dmp
    Filesize

    8KB

  • memory/1528-69-0x0000000000080000-0x00000000000B5000-memory.dmp
    Filesize

    212KB

  • memory/1528-65-0x0000000000000000-mapping.dmp