Analysis

  • max time kernel
    130s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    18-01-2022 22:03

General

  • Target

    03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll

  • Size

    633KB

  • MD5

    5a26d9ae9c7e910b86efcd6979f7ded6

  • SHA1

    f346145ac18ff4b2328db6ded32daa2cf070225a

  • SHA256

    03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a

  • SHA512

    de48a226caa8d46bd9f8fc957c84d72a8a5fcabfba64695d93c58fdd184844b50716b61df70bf3225ca99a15a2195de210af2e2f59fd74f7f1d78cbe65b3e265

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

C2

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass 2 TTPs
  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:892
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tnjyfab /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll\"" /SC ONCE /Z /ST 22:05 /ET 22:17
          4⤵
          • Creates scheduled task(s)
          PID:1544
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {FA5CEE24-8362-482F-81DA-7B8F232F64C8} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ospfb" /d "0"
            5⤵
              PID:1740
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Cofcehw" /d "0"
              5⤵
                PID:584

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Disabling Security Tools

      1
      T1089

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll
        MD5

        5a26d9ae9c7e910b86efcd6979f7ded6

        SHA1

        f346145ac18ff4b2328db6ded32daa2cf070225a

        SHA256

        03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a

        SHA512

        de48a226caa8d46bd9f8fc957c84d72a8a5fcabfba64695d93c58fdd184844b50716b61df70bf3225ca99a15a2195de210af2e2f59fd74f7f1d78cbe65b3e265

      • \Users\Admin\AppData\Local\Temp\03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a.dll
        MD5

        5a26d9ae9c7e910b86efcd6979f7ded6

        SHA1

        f346145ac18ff4b2328db6ded32daa2cf070225a

        SHA256

        03339ad3c87e35a6a0e59ace83ca82f0d37af9a858f3b25dab14b7ae8053835a

        SHA512

        de48a226caa8d46bd9f8fc957c84d72a8a5fcabfba64695d93c58fdd184844b50716b61df70bf3225ca99a15a2195de210af2e2f59fd74f7f1d78cbe65b3e265

      • memory/704-60-0x00000000000B0000-0x00000000000B2000-memory.dmp
        Filesize

        8KB

      • memory/704-65-0x0000000000080000-0x00000000000A1000-memory.dmp
        Filesize

        132KB

      • memory/704-64-0x0000000074F81000-0x0000000074F83000-memory.dmp
        Filesize

        8KB

      • memory/892-59-0x00000000001E0000-0x0000000000201000-memory.dmp
        Filesize

        132KB

      • memory/892-56-0x00000000001E0000-0x0000000000201000-memory.dmp
        Filesize

        132KB

      • memory/892-62-0x00000000002E0000-0x0000000000323000-memory.dmp
        Filesize

        268KB

      • memory/892-63-0x00000000001E0000-0x0000000000201000-memory.dmp
        Filesize

        132KB

      • memory/892-58-0x00000000001E0000-0x0000000000201000-memory.dmp
        Filesize

        132KB

      • memory/892-57-0x00000000001E0000-0x0000000000201000-memory.dmp
        Filesize

        132KB

      • memory/892-55-0x00000000008A0000-0x0000000000940000-memory.dmp
        Filesize

        640KB

      • memory/892-54-0x0000000076451000-0x0000000076453000-memory.dmp
        Filesize

        8KB

      • memory/1356-70-0x0000000000500000-0x00000000005A0000-memory.dmp
        Filesize

        640KB

      • memory/1356-72-0x0000000000480000-0x00000000004A1000-memory.dmp
        Filesize

        132KB

      • memory/1356-71-0x0000000000480000-0x00000000004A1000-memory.dmp
        Filesize

        132KB

      • memory/1356-74-0x0000000000480000-0x00000000004A1000-memory.dmp
        Filesize

        132KB

      • memory/1356-73-0x0000000000480000-0x00000000004A1000-memory.dmp
        Filesize

        132KB

      • memory/1356-78-0x0000000000480000-0x00000000004A1000-memory.dmp
        Filesize

        132KB

      • memory/1416-66-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp
        Filesize

        8KB

      • memory/1876-79-0x0000000000080000-0x00000000000A1000-memory.dmp
        Filesize

        132KB