Overview

overview

10

Static

static

xe1.dll

windows7_x64

10

xe1.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    21/02/2022, 14:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xe1.dll
  • Size 1.2MB
  • Sample220221-r7m13sbehj
  • SHA256 ee9aabd2fec3932993038ecf48b2fa192ca5d22c539b5c62be77019a0e77ef79
  • MD5 SHA1 SHA512
Score
10/10
qakbottr1645202931bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.532

Botnet

  • tr

Campaign

  • 1645202931

C2

  • 217.128.122.65:2222

  • 39.49.75.245:995

  • 217.165.146.122:32101

  • 173.174.216.62:443

  • 208.107.221.224:443

  • 92.177.45.46:2078

  • 119.158.116.122:995

  • 67.209.195.198:443

  • 32.221.231.1:443

  • 89.211.179.202:2222

  • 109.12.111.14:443

  • 70.45.27.254:443

  • 173.220.98.101:443

  • 75.156.151.34:443

  • 103.87.95.131:2222

  • 190.206.211.182:443

  • 2.50.41.69:61200

  • 82.152.39.39:443

  • 89.101.97.139:443

  • 176.45.252.83:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Drops file in Windows directory 6 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xe1.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\xe1.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ghelaviqpn /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\xe1.dll\"" /SC ONCE /Z /ST 07:24 /ET 07:36
          4⤵
          • Creates scheduled task(s)
          PID:3020
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4188

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3160-133-0x0000000002800000-0x000000000293C000-memory.dmp
        Download

        memory/3160-134-0x0000000074B20000-0x0000000074C4E000-memory.dmp
        Download

        memory/4188-130-0x000001764D580000-0x000001764D590000-memory.dmp
        Download

        memory/4188-131-0x000001764DD60000-0x000001764DD70000-memory.dmp
        Download

        memory/4188-132-0x0000017650960000-0x0000017650964000-memory.dmp
        Download

        memory/5052-135-0x0000000000960000-0x00000000009CC000-memory.dmp
        Download