Analysis

  • max time kernel
    146s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    07-11-2021 08:01

General

  • Target

    b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll

  • Size

    1.6MB

  • MD5

    4f7a4448b2e7d0618b86ee1eb62469e9

  • SHA1

    c5854232e23a72caa5a719dfb1badb58a98cac3a

  • SHA256

    b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

  • SHA512

    40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1634541613

C2

120.150.218.241:995

24.119.214.7:443

103.143.8.71:443

81.241.252.59:2078

81.250.153.227:2222

174.54.193.186:443

73.52.50.32:443

39.49.122.240:995

86.220.112.26:2222

103.82.211.39:465

78.191.38.33:995

216.201.162.158:443

181.118.183.94:443

66.177.215.152:0

208.78.220.143:443

94.200.181.154:443

136.232.34.70:443

136.143.11.232:443

81.213.59.22:443

103.82.211.39:990

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass 2 TTPs
  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kvraswwn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll\"" /SC ONCE /Z /ST 04:21 /ET 04:33
          4⤵
          • Creates scheduled task(s)
          PID:4612
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Oyxttligt" /d "0"
          4⤵
            PID:1756
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Gemagzsjnp" /d "0"
            4⤵
              PID:2044

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Disabling Security Tools

      1
      T1089

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
        MD5

        4f7a4448b2e7d0618b86ee1eb62469e9

        SHA1

        c5854232e23a72caa5a719dfb1badb58a98cac3a

        SHA256

        b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

        SHA512

        40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

      • \Users\Admin\AppData\Local\Temp\b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529.dll
        MD5

        4f7a4448b2e7d0618b86ee1eb62469e9

        SHA1

        c5854232e23a72caa5a719dfb1badb58a98cac3a

        SHA256

        b4abdad039b0eea9b5dae6f28c9945cb18d3603282866fb15c37697d14fff529

        SHA512

        40ca8de592e8cb4ff50e3fd5a82dc1a6695cc137efee27883e20f560dd47ed0b59c2fdb7a5c6fe71f94088abce3c69760b17bba9f480aa3b5fac44bdba6d49fc

      • memory/1260-133-0x0000000072E10000-0x0000000072FBB000-memory.dmp
        Filesize

        1.7MB

      • memory/1260-129-0x0000000000000000-mapping.dmp
      • memory/1260-134-0x0000000002B80000-0x0000000002B81000-memory.dmp
        Filesize

        4KB

      • memory/1260-132-0x0000000072E10000-0x0000000072E31000-memory.dmp
        Filesize

        132KB

      • memory/1260-131-0x0000000072E10000-0x0000000072FBB000-memory.dmp
        Filesize

        1.7MB

      • memory/1496-140-0x0000000002570000-0x0000000002591000-memory.dmp
        Filesize

        132KB

      • memory/1496-138-0x0000000002B60000-0x0000000002B61000-memory.dmp
        Filesize

        4KB

      • memory/1496-139-0x0000000002B60000-0x0000000002B61000-memory.dmp
        Filesize

        4KB

      • memory/1496-135-0x0000000000000000-mapping.dmp
      • memory/1756-136-0x0000000000000000-mapping.dmp
      • memory/2044-137-0x0000000000000000-mapping.dmp
      • memory/4484-119-0x00000000740D0000-0x000000007427B000-memory.dmp
        Filesize

        1.7MB

      • memory/4484-121-0x00000000740D0000-0x000000007427B000-memory.dmp
        Filesize

        1.7MB

      • memory/4484-118-0x0000000000000000-mapping.dmp
      • memory/4484-120-0x00000000740D0000-0x00000000740F1000-memory.dmp
        Filesize

        132KB

      • memory/4484-122-0x0000000003290000-0x0000000003291000-memory.dmp
        Filesize

        4KB

      • memory/4612-124-0x0000000000000000-mapping.dmp
      • memory/4636-127-0x0000000002E00000-0x0000000002E21000-memory.dmp
        Filesize

        132KB

      • memory/4636-126-0x0000000003100000-0x0000000003101000-memory.dmp
        Filesize

        4KB

      • memory/4636-125-0x0000000003100000-0x0000000003101000-memory.dmp
        Filesize

        4KB

      • memory/4636-123-0x0000000000000000-mapping.dmp