Overview

overview

10

Static

static

532f5a32f6...c8.dll

windows7_x64

10

532f5a32f6...c8.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    16/02/2022, 13:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll
  • Size 1.1MB
  • Sample220216-qsdnesdacn
  • SHA256 532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
  • MD5 SHA1 SHA512
Score
10/10
qakbottr1644836475bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.503

Botnet

  • tr

Campaign

  • 1644836475

C2

  • 220.255.25.1:2222

  • 180.233.150.134:995

  • 129.208.11.149:995

  • 102.65.38.67:443

  • 78.96.235.245:443

  • 24.53.49.240:443

  • 78.87.41.5:995

  • 136.143.11.232:443

  • 140.82.49.12:443

  • 111.125.245.116:995

  • 82.41.63.217:443

  • 24.178.196.158:2222

  • 38.70.253.226:2222

  • 74.15.2.252:2222

  • 92.177.45.46:2078

  • 209.210.95.228:32100

  • 37.211.176.26:61202

  • 149.135.101.20:443

  • 24.222.20.254:443

  • 96.21.251.127:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sjgbbysr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll\"" /SC ONCE /Z /ST 14:33 /ET 14:45
          4⤵
          • Creates scheduled task(s)
          PID:64
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:1980
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:3848
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:652
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8.dll"
      2⤵
      • Loads dropped DLL
      PID:384

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3916-130-0x0000000004370000-0x00000000044AD000-memory.dmp
        Download

        memory/3916-131-0x0000000074CE0000-0x0000000074DF6000-memory.dmp
        Download

        memory/4048-132-0x00000000006C0000-0x000000000072C000-memory.dmp
        Download