Overview

overview

10

Static

static

d246fc41b6...94.dll

windows7_x64

10

d246fc41b6...94.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    28/02/2022, 13:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94.dll
  • Size 1.2MB
  • Sample220228-qbmj1aece4
  • SHA256 d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94
  • MD5 SHA1 SHA512
Score
10/10
qakbottr1645202931bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.532

Botnet

  • tr

Campaign

  • 1645202931

C2

  • 217.128.122.65:2222

  • 39.49.75.245:995

  • 217.165.146.122:32101

  • 173.174.216.62:443

  • 208.107.221.224:443

  • 92.177.45.46:2078

  • 119.158.116.122:995

  • 67.209.195.198:443

  • 32.221.231.1:443

  • 89.211.179.202:2222

  • 109.12.111.14:443

  • 70.45.27.254:443

  • 173.220.98.101:443

  • 75.156.151.34:443

  • 103.87.95.131:2222

  • 190.206.211.182:443

  • 2.50.41.69:61200

  • 82.152.39.39:443

  • 89.101.97.139:443

  • 176.45.252.83:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mtkezzk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94.dll\"" /SC ONCE /Z /ST 14:09 /ET 14:21
          4⤵
          • Creates scheduled task(s)
          PID:3768

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1744-134-0x00000000004F0000-0x000000000055C000-memory.dmp
        Download

        memory/3688-130-0x00000000047C0000-0x00000000048FC000-memory.dmp
        Download

        memory/3688-131-0x0000000074DA0000-0x0000000074ECE000-memory.dmp
        Download