Overview

overview

10

Static

static

44483.5760...ac.dll

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10-ja-20211014
  • submitted
    15-10-2021 06:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44483.5760884259.wac.dll

  • Size

    500KB

  • MD5

    872d4e93263614ac34a7797908b14892

  • SHA1

    2f90402569177161bad5130205dc8d8adf5dcd7d

  • SHA256

    a86818684a994827ad2bdf3e23ec65cc750c7475e88dd0c7ac95d030fc032788

  • SHA512

    b43725484cec17f47886eed8772ee1d3090028c83d4e064adff52fd0a48178aafe7e32598d2f6452f0e217ffd13684669200167e87370bc87338eef7e35fb015

Score
10/10
qakbotobama1151634197867bankerdiscoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama115

Campaign

1634197867

C2

91.178.126.51:995

220.255.25.28:2222

208.78.220.143:443

77.31.162.93:443

73.230.205.91:443

216.201.162.158:443

94.200.181.154:443

24.231.209.2:2222

89.137.52.44:443

140.82.49.12:443

65.100.174.110:32103

41.86.42.158:995

27.223.92.142:995

200.232.214.222:995

81.250.153.227:2222

217.17.56.163:465

122.60.71.201:995

120.150.218.241:995

41.228.22.180:443

69.30.186.190:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Modifies system executable filetype association 2 TTPs 3 IoCs
    persistence
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Registers COM server for autorun 1 TTPs
    persistence
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:648
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn afwybpqavv /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll\"" /SC ONCE /Z /ST 13:46 /ET 13:58
          4⤵
          • Creates scheduled task(s)
          PID:820
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
      PID:3212
    • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
      "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
      1⤵
        PID:4696
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4808
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
            3⤵
            • Modifies system executable filetype association
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\FileSyncConfig.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\FileSyncConfig.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:2632
      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
        1⤵
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
          2⤵
            PID:3392
        • \??\c:\windows\system32\regsvr32.exe
          regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SysWOW64\regsvr32.exe
            -s "C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll"
            2⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              3⤵
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2808
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hyainu" /d "0"
                4⤵
                  PID:2088
                • C:\Windows\system32\reg.exe
                  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Xyvfzbm" /d "0"
                  4⤵
                    PID:3316

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Change Default File Association

            1
            T1042

            Registry Run Keys / Startup Folder

            2
            T1060

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Modify Registry

            4
            T1112

            Disabling Security Tools

            1
            T1089

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\FileSyncConfig.exe
              MD5

              83f0d36ff2faa2fa4e78118a030ab63e

              SHA1

              647169771a52908a49f0662fb43bfe94cab272c3

              SHA256

              9fee61464aabb430bb2e8545748263d9fccbbe9830cc22b4035728f8437931e0

              SHA512

              31f156dc1a04f34a7c563eb575c4e867de1fce9dc6554cde20c8bc6678eba75dd8a4bc2382286c11fc0c986861b33c53718eeae70e86cce36221a584dd78f0fe

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\LoggingPlatform.DLL
              MD5

              c556d77bd1b48cd05f608f8e4a50ab50

              SHA1

              da2f8d1d064a2c1ea73bfe2b54dc0e1bf3d971ea

              SHA256

              5eb5e4275907d5cb385f09b8c5d8377c1c80d96da245d4c292bf0339e0b385a7

              SHA512

              ee7167fe361b045832ee19e2694f7fcf1780681688f7d39a661f8da965c3a6b5ba5302970ad6099f324804f2079b237c250e9ab5f7c98501b2bd59f5ee2175af

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\MSVCP140.dll
              MD5

              20d7849113e030aa08d7c8520914b421

              SHA1

              1267d0b318e76f7c0378ec5385ab4706ea1910ab

              SHA256

              f5e51b4242dcbe2fadf3739f82d8b97877090fe0431ce10416b09d68e31c135c

              SHA512

              9a8841d55b7f3ac683fb460649b262e0da6e53511bfc6b26ae5cff29a6ddb2f2e9118a22b10f20d0f573f8d78cc1b4faa853391fe3f0953e71b710927a1bb83d

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\Telemetry.dll
              MD5

              e5ff3315699d88664e432f1b4bed6f3d

              SHA1

              c976371a8048fa4d7db30d33ab2c11cc398b2cea

              SHA256

              141033fab97f52c66cb6705fda26d75ef9c215c05e2f70530df58c640a2cf145

              SHA512

              78f0d1e863bbc575984d0a5e9adf7789eab1247b525988c6a5541e8f04db48f6e42a1e4cbd70dc11e9fddfad5d59f2510a2e79ff0cfaf42a7b04caeff8e98b52

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\UpdateRingSettings.dll
              MD5

              69cc32beb8138585a4e9c1cd1cd65bfd

              SHA1

              97445591e09eb7d830e83d2cf7a532b3ef98d4c9

              SHA256

              076f15674e101b32a01556b9cd8382e977ea73cceafe411e9213efc145470126

              SHA512

              5a99068a2bc7598f98b79e84ce0a3d0e4439212c4e66e31fbcefa06ef7af46c6f1ec2831ca667c3bce0e796cf3a2aa35bf08d0e3ff4bd4f0344080cb80ab315f

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\VCRUNTIME140.dll
              MD5

              b0c0482906e0847434d58ca0ea90d98b

              SHA1

              23b9ca65f4ea872e187677a951d2ef08e8fc87f4

              SHA256

              a95d38d5ccfc43a5749d8c5c1363005a960e9b09c8d90593e4ca6ac4ee64f8ea

              SHA512

              56a6f538e9e5148f9816c1cc66e708cf6b937cdf6cb48905d9495db83b9fa88e8161d1e8f6a4d923952454af0c81a780d45e92f1bacbef165ba37f5ca9f9d348

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
              MD5

              b73b0569e075f77f6e76658d7d792939

              SHA1

              d09a7e685846a83f3f3b83d85e47c379364133b7

              SHA256

              b04200b315b222b1c160f27598a290d34142d7125937ca4c91744a80ed45ae5a

              SHA512

              31a315c0d1270a4fc75fac612561b9ae5e671f94bf677105b69fbcbd970c098eac6bc9869de87386771690d39c32a2a5d2a7edc935b9a2a5f2e09760fc132abd

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
              MD5

              b73b0569e075f77f6e76658d7d792939

              SHA1

              d09a7e685846a83f3f3b83d85e47c379364133b7

              SHA256

              b04200b315b222b1c160f27598a290d34142d7125937ca4c91744a80ed45ae5a

              SHA512

              31a315c0d1270a4fc75fac612561b9ae5e671f94bf677105b69fbcbd970c098eac6bc9869de87386771690d39c32a2a5d2a7edc935b9a2a5f2e09760fc132abd

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
              MD5

              b73b0569e075f77f6e76658d7d792939

              SHA1

              d09a7e685846a83f3f3b83d85e47c379364133b7

              SHA256

              b04200b315b222b1c160f27598a290d34142d7125937ca4c91744a80ed45ae5a

              SHA512

              31a315c0d1270a4fc75fac612561b9ae5e671f94bf677105b69fbcbd970c098eac6bc9869de87386771690d39c32a2a5d2a7edc935b9a2a5f2e09760fc132abd

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
              MD5

              9e9c9e129a8c83b33ba23dc55dcc67bc

              SHA1

              35cf2bc119aa6f0006290d3728eeb37bb44bbcfa

              SHA256

              f6011c6df5208e2ccdcf09eaf9af17922f6aeda95bd1544d4cc31e9cef88bb99

              SHA512

              a89d1a4c213e0d6a8a703dbe78e4c0556a732ba1b527cbdfa0a083ba2f0e1f52b20b6f572008e8c80899235b7fddb389bde66956332f54bf7ad2aa2af0fd71d6

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll
              MD5

              872d4e93263614ac34a7797908b14892

              SHA1

              2f90402569177161bad5130205dc8d8adf5dcd7d

              SHA256

              a86818684a994827ad2bdf3e23ec65cc750c7475e88dd0c7ac95d030fc032788

              SHA512

              b43725484cec17f47886eed8772ee1d3090028c83d4e064adff52fd0a48178aafe7e32598d2f6452f0e217ffd13684669200167e87370bc87338eef7e35fb015

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\aria-debug-4704.log
              MD5

              3d199488cc30b3721fdc1416b4946be6

              SHA1

              1112e49b6d2cc8fdf86c02db98c4bc0727d69702

              SHA256

              f68b3013b65353e6d8a2746db7e99337aaba3ae000642ee8e04704d3e4ede31e

              SHA512

              4f33e5d77c0c241cf166ede965eae81332723917fe7ab25f0f0192956e8f1606d3620ad67aa861a5bb40b7b431192177dd6e1023a81982acd470d8085eaa210b

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\LoggingPlatform.dll
              MD5

              c556d77bd1b48cd05f608f8e4a50ab50

              SHA1

              da2f8d1d064a2c1ea73bfe2b54dc0e1bf3d971ea

              SHA256

              5eb5e4275907d5cb385f09b8c5d8377c1c80d96da245d4c292bf0339e0b385a7

              SHA512

              ee7167fe361b045832ee19e2694f7fcf1780681688f7d39a661f8da965c3a6b5ba5302970ad6099f324804f2079b237c250e9ab5f7c98501b2bd59f5ee2175af

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\Telemetry.dll
              MD5

              e5ff3315699d88664e432f1b4bed6f3d

              SHA1

              c976371a8048fa4d7db30d33ab2c11cc398b2cea

              SHA256

              141033fab97f52c66cb6705fda26d75ef9c215c05e2f70530df58c640a2cf145

              SHA512

              78f0d1e863bbc575984d0a5e9adf7789eab1247b525988c6a5541e8f04db48f6e42a1e4cbd70dc11e9fddfad5d59f2510a2e79ff0cfaf42a7b04caeff8e98b52

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\UpdateRingSettings.dll
              MD5

              69cc32beb8138585a4e9c1cd1cd65bfd

              SHA1

              97445591e09eb7d830e83d2cf7a532b3ef98d4c9

              SHA256

              076f15674e101b32a01556b9cd8382e977ea73cceafe411e9213efc145470126

              SHA512

              5a99068a2bc7598f98b79e84ce0a3d0e4439212c4e66e31fbcefa06ef7af46c6f1ec2831ca667c3bce0e796cf3a2aa35bf08d0e3ff4bd4f0344080cb80ab315f

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\msvcp140.dll
              MD5

              20d7849113e030aa08d7c8520914b421

              SHA1

              1267d0b318e76f7c0378ec5385ab4706ea1910ab

              SHA256

              f5e51b4242dcbe2fadf3739f82d8b97877090fe0431ce10416b09d68e31c135c

              SHA512

              9a8841d55b7f3ac683fb460649b262e0da6e53511bfc6b26ae5cff29a6ddb2f2e9118a22b10f20d0f573f8d78cc1b4faa853391fe3f0953e71b710927a1bb83d

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\vcruntime140.dll
              MD5

              b0c0482906e0847434d58ca0ea90d98b

              SHA1

              23b9ca65f4ea872e187677a951d2ef08e8fc87f4

              SHA256

              a95d38d5ccfc43a5749d8c5c1363005a960e9b09c8d90593e4ca6ac4ee64f8ea

              SHA512

              56a6f538e9e5148f9816c1cc66e708cf6b937cdf6cb48905d9495db83b9fa88e8161d1e8f6a4d923952454af0c81a780d45e92f1bacbef165ba37f5ca9f9d348

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\vcruntime140.dll
              MD5

              b0c0482906e0847434d58ca0ea90d98b

              SHA1

              23b9ca65f4ea872e187677a951d2ef08e8fc87f4

              SHA256

              a95d38d5ccfc43a5749d8c5c1363005a960e9b09c8d90593e4ca6ac4ee64f8ea

              SHA512

              56a6f538e9e5148f9816c1cc66e708cf6b937cdf6cb48905d9495db83b9fa88e8161d1e8f6a4d923952454af0c81a780d45e92f1bacbef165ba37f5ca9f9d348

              Download Submit
            • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\vcruntime140.dll
              MD5

              b0c0482906e0847434d58ca0ea90d98b

              SHA1

              23b9ca65f4ea872e187677a951d2ef08e8fc87f4

              SHA256

              a95d38d5ccfc43a5749d8c5c1363005a960e9b09c8d90593e4ca6ac4ee64f8ea

              SHA512

              56a6f538e9e5148f9816c1cc66e708cf6b937cdf6cb48905d9495db83b9fa88e8161d1e8f6a4d923952454af0c81a780d45e92f1bacbef165ba37f5ca9f9d348

              Download Submit
            • \Users\Admin\AppData\Local\Temp\44483.5760884259.wac.dll
              MD5

              872d4e93263614ac34a7797908b14892

              SHA1

              2f90402569177161bad5130205dc8d8adf5dcd7d

              SHA256

              a86818684a994827ad2bdf3e23ec65cc750c7475e88dd0c7ac95d030fc032788

              SHA512

              b43725484cec17f47886eed8772ee1d3090028c83d4e064adff52fd0a48178aafe7e32598d2f6452f0e217ffd13684669200167e87370bc87338eef7e35fb015

              Download Submit
            • memory/648-121-0x0000000002D80000-0x0000000002D81000-memory.dmp
              Filesize

              4KB

              Download
            • memory/648-119-0x0000000002780000-0x00000000027A1000-memory.dmp
              Filesize

              132KB

              Download
            • memory/648-118-0x0000000000000000-mapping.dmp
              Download
            • memory/820-120-0x0000000000000000-mapping.dmp
              Download
            • memory/2088-148-0x0000000000000000-mapping.dmp
              Download
            • memory/2268-144-0x0000000000000000-mapping.dmp
              Download
            • memory/2268-146-0x0000000002CC0000-0x0000000002E0A000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/2632-129-0x0000000000000000-mapping.dmp
              Download
            • memory/2808-147-0x0000000000000000-mapping.dmp
              Download
            • memory/2808-150-0x0000000003570000-0x0000000003571000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2808-151-0x0000000003570000-0x0000000003571000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2808-152-0x0000000002C80000-0x0000000002CA1000-memory.dmp
              Filesize

              132KB

              Download
            • memory/3316-149-0x0000000000000000-mapping.dmp
              Download
            • memory/3324-116-0x0000000002750000-0x000000000289A000-memory.dmp
              Filesize

              1.3MB

              Download
            • memory/3324-117-0x0000000010000000-0x000000001007F000-memory.dmp
              Filesize

              508KB

              Download
            • memory/3324-115-0x0000000000000000-mapping.dmp
              Download
            • memory/3392-128-0x0000000000000000-mapping.dmp
              Download
            • memory/4808-122-0x0000000000000000-mapping.dmp
              Download