Overview

overview

10

Static

static

9

f2d719b3ca...63.dll

windows7_x64

10

f2d719b3ca...63.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 22:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll

  • Size

    2.5MB

  • MD5

    34b83a5b23e2fa8c97a42649a3497085

  • SHA1

    2f0d9434b2cfac21e8ec8621b41f3084391ae426

  • SHA256

    f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463

  • SHA512

    1276e045721dd2134532cc4dd07ace2e8b4a03b4479112dd721b0ee291b46577028933aa0d3fc9a29b5e2616fee01225564b085c65529c4f1eb71f227ac2697e

Score
10/10
qakbotabc1171608747966bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn spzpmsuwiu /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll\"" /SC ONCE /Z /ST 09:27 /ET 09:39
          4⤵
          • Creates scheduled task(s)
          PID:4584
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll"
      2⤵
      • Loads dropped DLL
      PID:3508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 584
        3⤵
        • Program crash
        PID:2416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3508 -ip 3508
    1⤵
      PID:3380

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll
      MD5

      82436fdc008c9cd6c7f7e1227a1761d8

      SHA1

      122214c727bdcd1c87aee10564397872e4030c2d

      SHA256

      3d2855e39b6413bf4abe43a3f2099b51d3fe4412a72b8dd58a74f26f17da0c26

      SHA512

      d6aab84c2510963001e5e2873b6f17c0251ad2af68d3825e50aaeffeea0ffc031a5b9c4ab917b14d368a3a2bb0621c2bf513eee75a24fe327f16680293a3d239

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\f2d719b3ca3cf1a3277739c1569404585129640ffaeadaf95d3a134c5fe61463.dll
      MD5

      82436fdc008c9cd6c7f7e1227a1761d8

      SHA1

      122214c727bdcd1c87aee10564397872e4030c2d

      SHA256

      3d2855e39b6413bf4abe43a3f2099b51d3fe4412a72b8dd58a74f26f17da0c26

      SHA512

      d6aab84c2510963001e5e2873b6f17c0251ad2af68d3825e50aaeffeea0ffc031a5b9c4ab917b14d368a3a2bb0621c2bf513eee75a24fe327f16680293a3d239

      Download Submit
    • memory/804-132-0x0000000000A10000-0x0000000000E43000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/804-133-0x0000000001220000-0x0000000001254000-memory.dmp
      Filesize

      208KB

      Download
    • memory/1660-130-0x0000000002A30000-0x0000000002C1A000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/1660-131-0x0000000010000000-0x000000001028A000-memory.dmp
      Filesize

      2.5MB

      Download