Overview

overview

10

Static

static

9

6689b2acea...71.dll

windows7_x64

10

6689b2acea...71.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 21:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll

  • Size

    2.5MB

  • MD5

    9d7f0c2515959ad8fa00268a369e0af5

  • SHA1

    a1093488ed7cbeff077d42cf0a4bd62415cd42f5

  • SHA256

    6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771

  • SHA512

    259bfaa897f8ddfeb07a1294d4f577b5de4ef69885a2685962ee7bead75f0272d8d045e1253774771072087d62f25362e8f9b16bd7e88a08c3300ddfc6d3aa72

Score
10/10
qakbotabc1171608747966bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3612
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ixacxclyfo /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll\"" /SC ONCE /Z /ST 08:49 /ET 09:01
          4⤵
          • Creates scheduled task(s)
          PID:4280
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll"
      2⤵
      • Loads dropped DLL
      PID:4272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 584
        3⤵
        • Program crash
        PID:4584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4272 -ip 4272
    1⤵
      PID:4540

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll
      MD5

      8f5b2c49f817a39ee11ee871cbbecb2f

      SHA1

      2aa060320397d166d8b4958cfdfff7c874a5f6b7

      SHA256

      d3d45612c9312b7c2f78f708cae8bf7f27738b34eca458d3fc22d1e46d9b6fb1

      SHA512

      aac0ec24f190d76e3df0348f53c7645d464ddb407bb8a46f782183bc0b216d330189e7db168ec31f5e767d0f72d3c00df2f6c3bafc6887c5e06c7d34f4e5bd9a

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\6689b2acea3cd1095dc8f9438a4aaf140aa2fbaab48b201bb2a7b93963eb5771.dll
      MD5

      8f5b2c49f817a39ee11ee871cbbecb2f

      SHA1

      2aa060320397d166d8b4958cfdfff7c874a5f6b7

      SHA256

      d3d45612c9312b7c2f78f708cae8bf7f27738b34eca458d3fc22d1e46d9b6fb1

      SHA512

      aac0ec24f190d76e3df0348f53c7645d464ddb407bb8a46f782183bc0b216d330189e7db168ec31f5e767d0f72d3c00df2f6c3bafc6887c5e06c7d34f4e5bd9a

      Download Submit
    • memory/3612-132-0x00000000000C0000-0x00000000004F3000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/3612-133-0x0000000000720000-0x0000000000754000-memory.dmp
      Filesize

      208KB

      Download
    • memory/3688-130-0x0000000002540000-0x000000000272A000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/3688-131-0x0000000010000000-0x000000001028A000-memory.dmp
      Filesize

      2.5MB

      Download