Analysis

  • max time kernel
    125s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 23:16

General

  • Target

    b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll

  • Size

    2.5MB

  • MD5

    b1e560d1d96195d4979a2920ebc6fa3a

  • SHA1

    3f97c18a80621ce801a8d690cebba1e64ccd949c

  • SHA256

    b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351

  • SHA512

    665c326d87f27f5d285c08f8044678a2b68fe00261748ddefd4d7fa20adf87719d8d33a6b11678c3c216e78e29b15fc942ba6e4ee7602d5e4ec1944382233b7f

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fylrhux /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll\"" /SC ONCE /Z /ST 11:21 /ET 11:33
          4⤵
          • Creates scheduled task(s)
          PID:1388
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll"
      2⤵
      • Loads dropped DLL
      PID:4472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 584
        3⤵
        • Program crash
        PID:4952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4472 -ip 4472
    1⤵
      PID:5084

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll
      MD5

      0fdb39ecf109dd1a7ecae7784a5bfd94

      SHA1

      06fda367974dc4c422bb3fc2ee5ccb2a47570acd

      SHA256

      1b14c2fe0e9630430ed3a5366a0e82120b295f79a4c70b5006c1bfd59fa6e131

      SHA512

      17c5502ada7e6081757ac1b08fc2d92df885fb16fbbd8591f8313b41c8a5bb6333fd79e8438f301f377ffd88a08d212ac839bcba42323958e6693cd49f28897c

    • C:\Users\Admin\AppData\Local\Temp\b3c6c37f4bd2a9f13bbeae0885d3fc885b76b212b8e0736b2f8140555e1b9351.dll
      MD5

      0fdb39ecf109dd1a7ecae7784a5bfd94

      SHA1

      06fda367974dc4c422bb3fc2ee5ccb2a47570acd

      SHA256

      1b14c2fe0e9630430ed3a5366a0e82120b295f79a4c70b5006c1bfd59fa6e131

      SHA512

      17c5502ada7e6081757ac1b08fc2d92df885fb16fbbd8591f8313b41c8a5bb6333fd79e8438f301f377ffd88a08d212ac839bcba42323958e6693cd49f28897c

    • memory/3732-133-0x00000000026D0000-0x00000000028BA000-memory.dmp
      Filesize

      1.9MB

    • memory/3732-134-0x0000000010000000-0x000000001028A000-memory.dmp
      Filesize

      2.5MB

    • memory/4436-135-0x00000000009C0000-0x0000000000DF3000-memory.dmp
      Filesize

      4.2MB

    • memory/4436-136-0x0000000000600000-0x0000000000634000-memory.dmp
      Filesize

      208KB