Analysis

  • max time kernel
    4294193s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    09-03-2022 15:36

General

  • Target

    216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll

  • Size

    2.1MB

  • MD5

    a43b0d99d66e4b735feb0d56511ba853

  • SHA1

    1fa5db9da79a91a74bca6b66c82869879c844054

  • SHA256

    216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766

  • SHA512

    6c080fd1a6eda99dee6a45809d468be46fc7024bc0fba4cc5a64af84d942f9f21c1b016e0971f75f6b875423bd3ea1b5321d7c0781958d364385e627746b0b4e

Malware Config

Extracted

Family

qakbot

Version

401.62

Botnet

abc107

Campaign

1607078484

C2

32.212.117.188:443

109.205.204.229:2222

72.36.59.46:2222

173.18.126.193:2222

96.225.88.23:443

89.137.211.239:443

110.142.205.182:443

82.76.47.211:443

193.83.25.177:995

67.40.253.209:995

73.244.83.199:443

2.90.186.243:995

189.252.62.238:995

141.237.135.194:443

82.78.70.128:443

185.125.151.172:443

79.117.239.22:2222

86.189.252.131:2222

83.114.243.80:2222

2.50.56.81:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aaljsbnms /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll\"" /SC ONCE /Z /ST 12:47 /ET 12:59
          4⤵
          • Creates scheduled task(s)
          PID:1520
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {82897A7B-A7A2-43A2-BAE0-C1C96FFDA59C} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll"
        3⤵
        • Loads dropped DLL
        PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll
    MD5

    2fea894b06b9cab959541242b26779e0

    SHA1

    7444dd9eb11aa060176f12af0b6fcabd52ec859b

    SHA256

    0bcc13fb6ac0360e09814840cb66cfa989d7000da862b41d6ec11cf813406288

    SHA512

    a6b3b4272f2027e64337db9bc3413fa2d58645113131ac706f514cd78ad9761eb6dbb0f94bc3600fe263a944aabd2d81d9a4115447aea3e15aeab28216ea558b

  • \Users\Admin\AppData\Local\Temp\216878834cce781389c3b74f1e8e2c0c67ab547649c98e52eb8296f8f9ecd766.dll
    MD5

    2fea894b06b9cab959541242b26779e0

    SHA1

    7444dd9eb11aa060176f12af0b6fcabd52ec859b

    SHA256

    0bcc13fb6ac0360e09814840cb66cfa989d7000da862b41d6ec11cf813406288

    SHA512

    a6b3b4272f2027e64337db9bc3413fa2d58645113131ac706f514cd78ad9761eb6dbb0f94bc3600fe263a944aabd2d81d9a4115447aea3e15aeab28216ea558b

  • memory/560-59-0x00000000000B0000-0x00000000000B2000-memory.dmp
    Filesize

    8KB

  • memory/560-62-0x0000000074291000-0x0000000074293000-memory.dmp
    Filesize

    8KB

  • memory/560-63-0x00000000008D0000-0x0000000000B51000-memory.dmp
    Filesize

    2.5MB

  • memory/560-64-0x0000000000080000-0x00000000000A1000-memory.dmp
    Filesize

    132KB

  • memory/760-54-0x00000000753E1000-0x00000000753E3000-memory.dmp
    Filesize

    8KB

  • memory/760-55-0x0000000010000000-0x0000000010021000-memory.dmp
    Filesize

    132KB

  • memory/760-56-0x0000000010000000-0x0000000010021000-memory.dmp
    Filesize

    132KB

  • memory/760-57-0x0000000001F80000-0x000000000216A000-memory.dmp
    Filesize

    1.9MB

  • memory/760-58-0x0000000010000000-0x0000000010217000-memory.dmp
    Filesize

    2.1MB

  • memory/1292-65-0x000007FEFB541000-0x000007FEFB543000-memory.dmp
    Filesize

    8KB