Overview

overview

10

Static

static

Xertis.dll

windows7_x64

10

Xertis.dll

windows10_x64

10

Analysis

  • max time kernel
    105s
  • max time network
    104s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-09-2021 17:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xertis.dll

  • Size

    539KB

  • MD5

    def13557fb6fdec6b381c11c385215fa

  • SHA1

    58d1d3866645104de0304232ca8428153a7bc516

  • SHA256

    a11c88c0e58749006fd4a3a92959a589f5b23d2cfa081267963be299090e2604

  • SHA512

    2220965fde079f15399ae86a83f2ca014710d76613dc183e2d361782c9769d7626906e6858df709c6c66c7114039d84bf8e59204e5fc2574896822a38d29693c

Score
10/10
qakbotobama1021632302707bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

C2

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xertis.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xertis.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:996
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mtkyonyd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\Xertis.dll\"" /SC ONCE /Z /ST 19:28 /ET 19:40
          4⤵
          • Creates scheduled task(s)
          PID:1028
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\Xertis.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\Xertis.dll"
      2⤵
      • Loads dropped DLL
      PID:3592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Xertis.dll
    MD5

    d2142d0538ccd4db50771fad4701352c

    SHA1

    79ea35d4ca759ddbc3cb65e6663456ad4cae7b91

    SHA256

    75842f861fa6f920803a4466f0ea5047cbbb9ff89502f7011140321cdeb6e10f

    SHA512

    e9d98a4aab3230a650c9ae00f64256b21dfed28d76fd7df19c59ab8639a057618ebcb898b3bb151f622bd5ae13c0c10747bd6684714ad0f4358280873d3c0fd8

    Download Submit
  • \Users\Admin\AppData\Local\Temp\Xertis.dll
    MD5

    d2142d0538ccd4db50771fad4701352c

    SHA1

    79ea35d4ca759ddbc3cb65e6663456ad4cae7b91

    SHA256

    75842f861fa6f920803a4466f0ea5047cbbb9ff89502f7011140321cdeb6e10f

    SHA512

    e9d98a4aab3230a650c9ae00f64256b21dfed28d76fd7df19c59ab8639a057618ebcb898b3bb151f622bd5ae13c0c10747bd6684714ad0f4358280873d3c0fd8

    Download Submit
  • memory/816-114-0x0000000000000000-mapping.dmp
    Download
  • memory/816-116-0x00000000742D0000-0x0000000074371000-memory.dmp
    Filesize

    644KB

    Download
  • memory/816-115-0x00000000742D0000-0x00000000742F1000-memory.dmp
    Filesize

    132KB

    Download
  • memory/816-117-0x0000000000700000-0x000000000084A000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/996-118-0x0000000000000000-mapping.dmp
    Download
  • memory/996-119-0x0000000000BB0000-0x0000000000BD1000-memory.dmp
    Filesize

    132KB

    Download
  • memory/1028-120-0x0000000000000000-mapping.dmp
    Download
  • memory/3592-124-0x0000000000000000-mapping.dmp
    Download