Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    15-11-2021 14:47

General

  • Target

    e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll

  • Size

    545KB

  • MD5

    53510e20efb161d5b71c4ce2800c1a8d

  • SHA1

    2268178851d0d0debb9ab457d73af8a5e50af168

  • SHA256

    e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987

  • SHA512

    27f4f030928581d23212e18cfd0b33376677cef43ad5605e124cd80e2102cd1d559bf205ae1693e5e6567a6bd33d00d0e7209e32d503116d8b1594cb78ae69a3

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

tr

Campaign

1633597626

C2

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass ⋅ 2 TTPs
  • Loads dropped DLL ⋅ 1 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS ⋅ 10 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll,#1
    Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll,#1
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn iuncjixzwf /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll\"" /SC ONCE /Z /ST 23:33 /ET 23:45
          Creates scheduled task(s)
          PID:8
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll"
    Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll"
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        PID:584
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Irxolc" /d "0"
          PID:804
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Zktsydwtac" /d "0"
          PID:728

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll
                        MD5

                        53510e20efb161d5b71c4ce2800c1a8d

                        SHA1

                        2268178851d0d0debb9ab457d73af8a5e50af168

                        SHA256

                        e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987

                        SHA512

                        27f4f030928581d23212e18cfd0b33376677cef43ad5605e124cd80e2102cd1d559bf205ae1693e5e6567a6bd33d00d0e7209e32d503116d8b1594cb78ae69a3

                      • \??\PIPE\wkssvc
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • \Users\Admin\AppData\Local\Temp\e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987.dll
                        MD5

                        53510e20efb161d5b71c4ce2800c1a8d

                        SHA1

                        2268178851d0d0debb9ab457d73af8a5e50af168

                        SHA256

                        e2bc969424adc97345ac81194d316f58da38621aad3ca7ae27e40a8fae582987

                        SHA512

                        27f4f030928581d23212e18cfd0b33376677cef43ad5605e124cd80e2102cd1d559bf205ae1693e5e6567a6bd33d00d0e7209e32d503116d8b1594cb78ae69a3

                      • memory/8-119-0x0000000000000000-mapping.dmp
                      • memory/584-133-0x0000000003180000-0x0000000003181000-memory.dmp
                      • memory/584-132-0x0000000003180000-0x0000000003181000-memory.dmp
                      • memory/584-127-0x0000000000000000-mapping.dmp
                      • memory/584-130-0x0000000000830000-0x0000000000851000-memory.dmp
                      • memory/728-131-0x0000000000000000-mapping.dmp
                      • memory/804-129-0x0000000000000000-mapping.dmp
                      • memory/3368-121-0x0000000000580000-0x00000000005A1000-memory.dmp
                      • memory/3368-122-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
                      • memory/3368-120-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
                      • memory/3368-118-0x0000000000000000-mapping.dmp
                      • memory/4108-117-0x0000000010000000-0x000000001530B000-memory.dmp
                      • memory/4108-116-0x0000000004B30000-0x0000000009DE4000-memory.dmp
                      • memory/4108-115-0x0000000000000000-mapping.dmp
                      • memory/4288-126-0x0000000003790000-0x0000000008A44000-memory.dmp
                      • memory/4288-124-0x0000000000000000-mapping.dmp