Overview

overview

10

Static

static

9

c8677c883b...dc.dll

windows7_x64

10

c8677c883b...dc.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-02-2022 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc.dll

  • Size

    1.5MB

  • MD5

    8ea4736e396e88af0e99f7bdfd4594fb

  • SHA1

    6cc434de8285f22474009323e0a505fd35d22d21

  • SHA256

    c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc

  • SHA512

    2bcd434a9d6314e631b2b408d5d735e2c7639f0eb468a7efcb068e1352d0724ba43ca03712333b34be2d92268ee5cf552e4dbaa5948a289d701b489dcba77843

Score
10/10
qakbotabc1001606289576bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

abc100

Campaign

1606289576

C2

198.2.35.226:2222

84.78.128.76:2078

120.150.34.178:443

24.201.61.153:2078

217.128.117.218:2222

217.133.54.140:32100

156.205.56.98:995

98.26.50.62:995

172.114.116.226:995

109.209.94.165:2222

72.190.101.70:443

92.59.35.196:2083

37.107.82.136:443

85.132.36.111:2222

174.76.11.123:995

219.74.176.225:443

98.118.156.172:443

94.59.120.142:443

72.29.181.78:2078

178.223.20.246:995
Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc.dll,#1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qdbvyklbis /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc.dll\"" /SC ONCE /Z /ST 11:11 /ET 11:23
          4⤵
          • Creates scheduled task(s)
          PID:4424
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 624
        3⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3220
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3688
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1460 -ip 1460
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:2032
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4772
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\c8677c883baa17463ada5e562f5c7bb85ebaa977f1b5f15dee1b4b8bf7ec59dc.dll"
    1⤵
      PID:400

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1460-133-0x0000000002910000-0x0000000002A80000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1460-134-0x0000000010000000-0x0000000010020000-memory.dmp
      Filesize

      128KB

      Download
    • memory/3688-130-0x00000172D3760000-0x00000172D3770000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3688-131-0x00000172D3E20000-0x00000172D3E30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3688-132-0x00000172D64E0000-0x00000172D64E4000-memory.dmp
      Filesize

      16KB

      Download
    • memory/4164-135-0x0000000000F43000-0x0000000000F44000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4164-136-0x00000000013A0000-0x00000000013C0000-memory.dmp
      Filesize

      128KB

      Download