Overview

overview

10

Static

static

f6710a55cf...5f.dll

windows7_x64

10

f6710a55cf...5f.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    17/02/2022, 13:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll
  • Size 867KB
  • Sample220217-q356escdbq
  • SHA256 f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f
  • MD5 SHA1 SHA512
Score
10/10
qakbottr1644947846bankerevasionstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.509

Botnet

  • tr

Campaign

  • 1644947846

C2

  • 89.101.97.139:443

  • 37.211.176.26:61202

  • 70.51.137.204:2222

  • 72.252.201.34:990

  • 72.252.201.34:995

  • 72.66.116.235:995

  • 173.21.10.71:2222

  • 45.9.20.200:443

  • 75.156.151.34:443

  • 2.50.41.69:61200

  • 31.35.28.29:443

  • 100.1.108.246:443

  • 67.209.195.198:443

  • 89.211.208.234:2222

  • 217.164.115.166:2222

  • 161.142.54.62:443

  • 96.246.158.154:995

  • 190.73.3.148:2222

  • 41.228.22.180:443

  • 108.4.67.252:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cnfwdtvtq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll\"" /SC ONCE /Z /ST 13:50 /ET 14:02
          4⤵
          • Creates scheduled task(s)
          PID:1400
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2564
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4056
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\f6710a55cf52bc8ddc529ef256c6c25dae476d55fa0794f7e116d7ab040d705f.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Azkeeynbs" /d "0"
          4⤵
            PID:2280
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Viznhd" /d "0"
            4⤵
              PID:5112

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1108-133-0x0000000002C00000-0x0000000002D38000-memory.dmp
            Download

            memory/1108-134-0x0000000074A60000-0x0000000074B3A000-memory.dmp
            Download

            memory/2564-130-0x0000017812F20000-0x0000017812F30000-memory.dmp
            Download

            memory/2564-131-0x0000017813140000-0x0000017813150000-memory.dmp
            Download

            memory/2564-132-0x0000017815630000-0x0000017815634000-memory.dmp
            Download

            memory/2680-138-0x0000000074D70000-0x0000000074E4A000-memory.dmp
            Download

            memory/2708-139-0x0000000001200000-0x000000000126C000-memory.dmp
            Download

            memory/3544-135-0x0000000001200000-0x000000000126C000-memory.dmp
            Download