Analysis

  • max time kernel
    129s
  • max time network
    83s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    28-04-2021 20:40

General

  • Target

    03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll

  • Size

    400KB

  • MD5

    20b347dc15613731322ed168fcacfe61

  • SHA1

    874bde28492b1edfb2f0376770385fbfdf7aeec4

  • SHA256

    03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8

  • SHA512

    3569d7e5feed164f060e1f62188612f59996e094b3b38f26750b7e22c740f9405ace9b0efe006b8cfd574994d7fd7c373e5f87e6de63cf483ce02341735864f3

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

biden02

Campaign

1614154620

C2

98.173.34.213:995

160.3.187.114:443

73.25.124.140:2222

24.50.118.93:443

82.127.125.209:990

83.110.109.106:2222

79.129.121.81:995

189.223.234.23:995

125.63.101.62:443

113.22.175.141:443

172.78.30.215:443

47.146.169.85:443

47.22.148.6:443

76.25.142.196:443

78.63.226.32:443

105.198.236.101:443

75.67.192.125:443

176.181.247.197:443

105.96.8.96:443

108.31.15.10:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tqcwupajs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll\"" /SC ONCE /Z /ST 20:50 /ET 21:02
          4⤵
          • Creates scheduled task(s)
          PID:1760
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {16385611-AE4C-43B8-9AFD-A84114317AEF} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll"
        3⤵
        • Loads dropped DLL
        PID:1336

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll
    MD5

    c61b1257e2db68b8a54b8218882d43c5

    SHA1

    72bacd2e3ca668dc01af05c99f20b9eb6c9dcd31

    SHA256

    0006cd03e95e1b2219198812a470082d09fd84dd16adc72c518d709dbf4be44d

    SHA512

    7cdd28178da58c0cda5391d6dfc0607cd384192645a789f8da8c1d54db3d840b5d0e8c194bdb923cd7bfcc0da1b75398cf723e2187a374915915902b36d9d7bb

  • \Users\Admin\AppData\Local\Temp\03b4725f98d94b42dc91823784d4e53a26c77b9efb54e156facae22577ee9ba8.dll
    MD5

    c61b1257e2db68b8a54b8218882d43c5

    SHA1

    72bacd2e3ca668dc01af05c99f20b9eb6c9dcd31

    SHA256

    0006cd03e95e1b2219198812a470082d09fd84dd16adc72c518d709dbf4be44d

    SHA512

    7cdd28178da58c0cda5391d6dfc0607cd384192645a789f8da8c1d54db3d840b5d0e8c194bdb923cd7bfcc0da1b75398cf723e2187a374915915902b36d9d7bb

  • memory/896-69-0x0000000000000000-mapping.dmp
  • memory/1052-59-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp
    Filesize

    8KB

  • memory/1280-63-0x0000000010000000-0x0000000010066000-memory.dmp
    Filesize

    408KB

  • memory/1280-62-0x00000000001E0000-0x0000000000260000-memory.dmp
    Filesize

    512KB

  • memory/1280-60-0x0000000000000000-mapping.dmp
  • memory/1280-61-0x0000000075721000-0x0000000075723000-memory.dmp
    Filesize

    8KB

  • memory/1336-72-0x0000000000000000-mapping.dmp
  • memory/1644-64-0x0000000000000000-mapping.dmp
  • memory/1644-66-0x0000000074321000-0x0000000074323000-memory.dmp
    Filesize

    8KB

  • memory/1644-67-0x00000000000C0000-0x00000000000F5000-memory.dmp
    Filesize

    212KB

  • memory/1760-68-0x0000000000000000-mapping.dmp