Analysis
-
max time kernel
1798s -
max time network
1805s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 20:53
General
-
Target
test.test.dll
-
Size
355KB
-
MD5
ed3b43ef66f58f891cc51cacc79b0b72
-
SHA1
02cfa19d275c96fafad6b3e440b220200b839f99
-
SHA256
9c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
-
SHA512
73913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
Malware Config
Extracted
qakbot
402.343
tr
1632730751
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Windows security bypass 2 TTPs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wsnusccdt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\test.test.dll\"" /SC ONCE /Z /ST 20:55 /ET 21:074⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hytfw" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Bgxvnnmeqg" /d "0"4⤵
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\test.test.dll"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 6043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
ed3b43ef66f58f891cc51cacc79b0b72
SHA102cfa19d275c96fafad6b3e440b220200b839f99
SHA2569c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
SHA51273913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
-
C:\Users\Admin\AppData\Local\Temp\test.test.dllMD5
83aa0f585f885db7ea32b8b38060df9f
SHA1180bde533d03dbcad86dd4a7cade5cebc7df7d7d
SHA256266faa5fab81575b32be38012258449bfea523b04ce9b29353953fb4b6dd74de
SHA5120018a52019b082ee75128158f30860a2cdcf0e422cc6a2ad119ae8667d454be30fda86a9f047f30cb411699d57b2a8ea3b10bbf6b6e346c986dc2468024608bf
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
ed3b43ef66f58f891cc51cacc79b0b72
SHA102cfa19d275c96fafad6b3e440b220200b839f99
SHA2569c5c2af628233f118a88fb03f859e0f92f4393c8dd7c8204afe15af161f568c7
SHA51273913ebf9895625de2b4a4e5c4534164f79b708bfc1338aade1d90aae57836bd7ea79e2a32976b138d8d5ab1d877ec5997428461acb588e732ec49ab8235d116
-
\Users\Admin\AppData\Local\Temp\test.test.dllMD5
83aa0f585f885db7ea32b8b38060df9f
SHA1180bde533d03dbcad86dd4a7cade5cebc7df7d7d
SHA256266faa5fab81575b32be38012258449bfea523b04ce9b29353953fb4b6dd74de
SHA5120018a52019b082ee75128158f30860a2cdcf0e422cc6a2ad119ae8667d454be30fda86a9f047f30cb411699d57b2a8ea3b10bbf6b6e346c986dc2468024608bf
-
memory/1368-129-0x0000000000000000-mapping.dmp
-
memory/2504-122-0x00000000004E0000-0x0000000000501000-memory.dmpFilesize
132KB
-
memory/2504-118-0x0000000000000000-mapping.dmp
-
memory/2560-128-0x0000000000000000-mapping.dmp
-
memory/2756-119-0x0000000000000000-mapping.dmp
-
memory/2844-115-0x0000000000000000-mapping.dmp
-
memory/2844-116-0x0000000004D20000-0x0000000004DAE000-memory.dmpFilesize
568KB
-
memory/2844-117-0x0000000010000000-0x0000000010055000-memory.dmpFilesize
340KB
-
memory/3048-134-0x0000000000000000-mapping.dmp
-
memory/3576-124-0x0000000000000000-mapping.dmp
-
memory/3576-126-0x0000000003430000-0x0000000003473000-memory.dmpFilesize
268KB
-
memory/3668-127-0x0000000000000000-mapping.dmp
-
memory/3668-132-0x0000000002F30000-0x0000000002F51000-memory.dmpFilesize
132KB