Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    22-12-2021 17:26

General

  • Target

    f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll

  • Size

    680KB

  • MD5

    bc77db5e71744abff1ee82e51524fbe2

  • SHA1

    95ea877d90b180c21e18ff0862c56e34f6423e29

  • SHA256

    f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7

  • SHA512

    b77e7a056c87461ec2677c598ae26c6ed8f99f7ea3274bdc8b6e069a06a7222b70482e8db57fbfba6c6ead997cf76d88cbeb3f0c10eeeaaab43a0e41c2d197b0

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639988898

C2

32.221.229.7:443

140.82.49.12:443

24.152.219.253:995

182.56.99.126:443

76.169.147.192:32103

218.101.110.3:995

89.101.97.139:443

82.152.39.39:443

176.24.150.197:443

96.37.113.36:993

68.186.192.69:443

59.88.168.108:443

75.110.250.187:443

182.191.92.203:995

89.165.88.95:443

103.142.10.177:443

45.9.20.200:2211

24.95.61.62:443

194.36.28.26:443

78.101.82.198:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uqhufjaadb /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f4671690ddeb683f87d12173b47d33d1ec18cb4b8c7e300397ee76b214d92cc7.dll\"" /SC ONCE /Z /ST 17:28 /ET 17:40
          4⤵
          • Creates scheduled task(s)
          PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-118-0x0000000000000000-mapping.dmp
  • memory/2688-120-0x00000000036C0000-0x00000000036C1000-memory.dmp
    Filesize

    4KB

  • memory/2688-121-0x00000000036C0000-0x00000000036C1000-memory.dmp
    Filesize

    4KB

  • memory/2688-122-0x0000000000D00000-0x0000000000D21000-memory.dmp
    Filesize

    132KB

  • memory/2760-119-0x0000000000000000-mapping.dmp
  • memory/2876-115-0x0000000000000000-mapping.dmp
  • memory/2876-116-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
    Filesize

    4KB

  • memory/2876-117-0x0000000010000000-0x000000001010D000-memory.dmp
    Filesize

    1.1MB