Overview

overview

10

Static

static

2d9e8dcb-f...1a.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    113s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    26-01-2022 22:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2d9e8dcb-f28b-45d4-b5ba-6850f070b01a.dll

  • Size

    643KB

  • MD5

    256097ecef14069625885fad823e04ff

  • SHA1

    c3cee8d36ee9a57f5891c7ef5540d329ec0eae51

  • SHA256

    6f13ffc3e433ee9ad79623d2dbf2db10fde428ab8afc5372c80e68cc5497d70e

  • SHA512

    01086d367655adfbbdf7c81b447f05abf374362332901a70705d980e8e02bb5033d511953c774672a9ed6ff35a002a1fb60ee6b7bfc9ced2c78f64e0d6ab89d0

Score
10/10
qakbotcullinan1640084934bankerpersistencestealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Registers COM server for autorun 1 TTPs
    persistence
  • Executes dropped EXE 1 IoCs
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d9e8dcb-f28b-45d4-b5ba-6850f070b01a.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\2d9e8dcb-f28b-45d4-b5ba-6850f070b01a.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yixkvie /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\2d9e8dcb-f28b-45d4-b5ba-6850f070b01a.dll\"" /SC ONCE /Z /ST 23:42 /ET 23:54
          4⤵
          • Creates scheduled task(s)
          PID:3728
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 1cb985c4132e49b761b2f6db920c9f88 YQrEdCFXz06ODjFLt2s8rg.0.1.0.0.0
    1⤵
    • Modifies data under HKEY_USERS
    PID:1580
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3980
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
      1⤵
        PID:1944
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
        1⤵
        • Modifies system executable filetype association
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
          2⤵
          • Executes dropped EXE
          PID:1264

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Change Default File Association

      1
      T1042

      Registry Run Keys / Startup Folder

      2
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      3
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
        MD5

        af3a75add0d274c45089082aa7c63b9f

        SHA1

        4db7969deb9a4cd072c656640a8ba0faa33e6d95

        SHA256

        c5dca3621793b7d152df8b3f0cdaa8e893e7548dca139bb27cc137d2bcc94097

        SHA512

        f02a989c02e1870ab0aaffcf0ee0910d04aed60a96b0caddfabe14c6e6e0a8e96d64b6022a18f4ed827b9c3cedec6612eb67733eeb083bd9e556459809e3689b

        Download Submit
      • memory/1320-133-0x0000000002E50000-0x0000000002E71000-memory.dmp
        Filesize

        132KB

        Download
      • memory/2132-130-0x0000000004A40000-0x0000000004ABB000-memory.dmp
        Filesize

        492KB

        Download
      • memory/2132-131-0x0000000004AC0000-0x0000000004C63000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/2132-132-0x0000000000400000-0x00000000004A2000-memory.dmp
        Filesize

        648KB

        Download