Analysis
-
max time kernel
1800s -
max time network
1802s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 20:53
General
-
Target
test.test.dll
-
Size
355KB
-
MD5
ed3b43ef66f58f891cc51cacc79b0b72
-
SHA1
02cfa19d275c96fafad6b3e440b220200b839f99
-
SHA256
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
-
SHA512
73913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
Malware Config
Extracted
qakbot
402.343
tr
1632730751
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass 2 TTPs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn lymnvugt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 22:55 /ET 23:074⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Owame" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Iojdmno" /d "0"4⤵
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 5963⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
ed3b43ef66f58f891cc51cacc79b0b72
SHA102cfa19d275c96fafad6b3e440b220200b839f99
SHA2569c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
SHA51273913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
83aa0f585f885db7ea32b8b38060df9f
SHA1180bde533d03dbcad86dd4a7cade5cebc7df7d7d
SHA256266faa5fab81575b32be38012258449bfea523b04ce9b29353953fb4b6dd74de
SHA5120018a52019b082ee75128158f30860a2cdcf0e422cc6a2ad119ae8667d454be30fda86a9f047f30cb411699d57b2a8ea3b10bbf6b6e346c986dc2468024608bf
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
ed3b43ef66f58f891cc51cacc79b0b72
SHA102cfa19d275c96fafad6b3e440b220200b839f99
SHA2569c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
SHA51273913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
83aa0f585f885db7ea32b8b38060df9f
SHA1180bde533d03dbcad86dd4a7cade5cebc7df7d7d
SHA256266faa5fab81575b32be38012258449bfea523b04ce9b29353953fb4b6dd74de
SHA5120018a52019b082ee75128158f30860a2cdcf0e422cc6a2ad119ae8667d454be30fda86a9f047f30cb411699d57b2a8ea3b10bbf6b6e346c986dc2468024608bf
-
memory/1032-128-0x0000000000000000-mapping.dmp
-
memory/1108-114-0x0000000000000000-mapping.dmp
-
memory/1108-115-0x0000000004550000-0x0000000004593000-memory.dmpFilesize
268KB
-
memory/1108-116-0x0000000010000000-0x0000000010055000-memory.dmpFilesize
340KB
-
memory/1200-127-0x0000000000000000-mapping.dmp
-
memory/1200-132-0x0000000002A00000-0x0000000002A21000-memory.dmpFilesize
132KB
-
memory/1252-121-0x0000000002CF0000-0x0000000002D11000-memory.dmpFilesize
132KB
-
memory/1252-117-0x0000000000000000-mapping.dmp
-
memory/1344-134-0x0000000000000000-mapping.dmp
-
memory/1368-118-0x0000000000000000-mapping.dmp
-
memory/1568-129-0x0000000000000000-mapping.dmp
-
memory/3888-123-0x0000000000000000-mapping.dmp
-
memory/3888-125-0x0000000003950000-0x0000000003993000-memory.dmpFilesize
268KB