Analysis

  • max time kernel
    1197s
  • max time network
    1198s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    20-10-2021 14:48

General

  • Target

    44484.6871458333.dat.dll

  • Size

    905KB

  • MD5

    028851f519f904c1f367dcc2f17612b4

  • SHA1

    3b5f3470e00b8064d233a2e2fb8011d3474e7cd9

  • SHA256

    99c7d40784fe46cc9acd304219a554ce378b7832a602866e352d9562f191d703

  • SHA512

    6cb05daf1f132bec4c924104b66578033f4450d5af0e28b049c8f0c3476b5b65548e728d7a3bcb4e780a4c121e48329fefc1f07c5e1bb72218d64e60046e3d49

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama116

Campaign

1634289383

C2

41.228.22.180:443

188.55.249.239:995

120.150.218.241:995

37.117.191.19:2222

68.204.7.158:443

81.241.252.59:2078

196.207.140.40:995

174.54.193.186:443

63.143.92.99:995

197.89.144.200:443

86.220.112.26:2222

73.52.50.32:443

103.82.211.39:465

146.66.238.74:443

167.248.117.81:443

2.222.167.138:443

181.118.183.94:443

103.82.211.39:995

78.179.137.102:995

89.137.52.44:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zxewubbdsn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\44484.6871458333.dat.dll\"" /SC ONCE /Z /ST 23:54 /ET 24:06
          4⤵
          • Creates scheduled task(s)
          PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/420-120-0x0000000000000000-mapping.dmp
  • memory/420-122-0x0000000000A80000-0x0000000000A81000-memory.dmp
    Filesize

    4KB

  • memory/420-123-0x0000000000A80000-0x0000000000A81000-memory.dmp
    Filesize

    4KB

  • memory/420-124-0x0000000000570000-0x0000000000591000-memory.dmp
    Filesize

    132KB

  • memory/1156-121-0x0000000000000000-mapping.dmp
  • memory/3464-115-0x0000000000000000-mapping.dmp
  • memory/3464-116-0x0000000073E80000-0x0000000074005000-memory.dmp
    Filesize

    1.5MB

  • memory/3464-118-0x0000000073E80000-0x0000000074005000-memory.dmp
    Filesize

    1.5MB

  • memory/3464-117-0x0000000073E80000-0x0000000073EA1000-memory.dmp
    Filesize

    132KB

  • memory/3464-119-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
    Filesize

    4KB