ocrafh.html

General
Target

ocrafh.html.dll

Filesize

819KB

Completed

12-10-2021 13:08

Score
10/10
MD5

2897721785645ad5b2a8fb524ed650c0

SHA1

d836fa75f0682b4c393418231aefca97169d551e

SHA256

956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

Malware Config

Extracted

Family qakbot
Version 402.363
Botnet tr
Campaign 1633597626
C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

122.11.220.212:2222

78.191.58.219:995

47.22.148.6:443

74.72.237.54:443

217.17.56.163:465

96.57.188.174:2078

94.200.181.154:443

37.210.152.224:995

201.93.111.2:995

202.134.178.157:443

89.101.97.139:443

73.52.50.32:443

188.55.235.110:995

27.223.92.142:995

181.118.183.94:443

136.232.34.70:443

186.32.163.199:443

72.173.78.211:443

76.25.142.196:443

45.46.53.140:2222

98.157.235.126:443

173.21.10.71:2222

73.151.236.31:443

71.74.12.34:443

75.75.179.226:443

167.248.117.81:443

67.165.206.193:993

47.40.196.233:2222

72.252.201.69:443

181.4.53.6:465

Signatures 6

Filter: none

Persistence
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL
    regsvr32.exe

    Reported IOCs

    pidprocess
    2124regsvr32.exe
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    3600schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    3156rundll32.exe
    3156rundll32.exe
  • Suspicious behavior: MapViewOfSection
    rundll32.exe

    Reported IOCs

    pidprocess
    3156rundll32.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exerundll32.exeexplorer.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 532 wrote to memory of 3156532rundll32.exerundll32.exe
    PID 532 wrote to memory of 3156532rundll32.exerundll32.exe
    PID 532 wrote to memory of 3156532rundll32.exerundll32.exe
    PID 3156 wrote to memory of 30163156rundll32.exeexplorer.exe
    PID 3156 wrote to memory of 30163156rundll32.exeexplorer.exe
    PID 3156 wrote to memory of 30163156rundll32.exeexplorer.exe
    PID 3156 wrote to memory of 30163156rundll32.exeexplorer.exe
    PID 3156 wrote to memory of 30163156rundll32.exeexplorer.exe
    PID 3016 wrote to memory of 36003016explorer.exeschtasks.exe
    PID 3016 wrote to memory of 36003016explorer.exeschtasks.exe
    PID 3016 wrote to memory of 36003016explorer.exeschtasks.exe
    PID 2004 wrote to memory of 21242004regsvr32.exeregsvr32.exe
    PID 2004 wrote to memory of 21242004regsvr32.exeregsvr32.exe
    PID 2004 wrote to memory of 21242004regsvr32.exeregsvr32.exe
Processes 6
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll,#1
    Suspicious use of WriteProcessMemory
    PID:532
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll,#1
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aernstdhol /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll\"" /SC ONCE /Z /ST 20:24 /ET 20:36
          Creates scheduled task(s)
          PID:3600
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll"
    Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll"
      Loads dropped DLL
      PID:2124
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\ocrafh.html.dll

                          MD5

                          2897721785645ad5b2a8fb524ed650c0

                          SHA1

                          d836fa75f0682b4c393418231aefca97169d551e

                          SHA256

                          956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

                          SHA512

                          f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a

                        • \Users\Admin\AppData\Local\Temp\ocrafh.html.dll

                          MD5

                          2897721785645ad5b2a8fb524ed650c0

                          SHA1

                          d836fa75f0682b4c393418231aefca97169d551e

                          SHA256

                          956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85

                          SHA512

                          f40e3cd7ab855c3d5513efb0c84b831a538226a8baa7d743368989dcb5461b3d0ef7dd5cdd9a538a48835aebe60044e9bfdc063e5fb19cce7fecabe213c2786a

                        • memory/2124-125-0x0000000000000000-mapping.dmp

                        • memory/3016-123-0x0000000000160000-0x0000000000161000-memory.dmp

                        • memory/3016-122-0x0000000000160000-0x0000000000161000-memory.dmp

                        • memory/3016-119-0x0000000000000000-mapping.dmp

                        • memory/3016-120-0x0000000000960000-0x0000000000981000-memory.dmp

                        • memory/3156-118-0x00000000034F0000-0x00000000034F1000-memory.dmp

                        • memory/3156-116-0x0000000074240000-0x0000000074261000-memory.dmp

                        • memory/3156-117-0x0000000074240000-0x00000000743B1000-memory.dmp

                        • memory/3156-115-0x0000000074240000-0x00000000743B1000-memory.dmp

                        • memory/3156-114-0x0000000000000000-mapping.dmp

                        • memory/3600-121-0x0000000000000000-mapping.dmp