Analysis

  • max time kernel
    159s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 16:00

General

  • Target

    669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll

  • Size

    2.4MB

  • MD5

    88b2e94cc06f10e174c6246b1c42ace8

  • SHA1

    0f90ae145db8af60c0ed44a5ccb113c088bc3dc2

  • SHA256

    669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f

  • SHA512

    f4360bb0923ea0f319cd0fe496bc386d9834afbe90fc6e37dcd232b6872f66a5ff5a025684d464eba5411d9a251b6eb41c8e5e6f8d307e760e9f001550bb8c55

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608719407

C2

41.39.134.183:443

113.193.187.2:995

90.188.91.57:995

176.181.247.197:443

78.191.87.198:20

83.110.241.182:443

93.149.167.254:2222

76.111.128.194:443

32.212.117.188:443

72.36.59.46:2222

68.186.192.69:443

94.98.248.152:443

105.226.38.36:443

92.154.83.96:2222

37.210.255.225:995

74.195.52.3:443

73.166.10.38:443

95.77.223.148:443

80.227.5.70:443

91.104.104.63:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sbmmhpy /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll\"" /SC ONCE /Z /ST 22:29 /ET 22:41
          4⤵
          • Creates scheduled task(s)
          PID:3608
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll"
      2⤵
      • Loads dropped DLL
      PID:4024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 592
        3⤵
        • Program crash
        PID:4112
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 4024
    1⤵
      PID:5108

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll
      MD5

      ee1c304eaa7e2756b373b7db3b5c857f

      SHA1

      d36f1b6e276500b496e72ecbc4b16626923f49e1

      SHA256

      1578ff3ffe383ccfbf1766b4adde351088b3466479772fae6b8bfba2a7fb4cff

      SHA512

      f0bb3ffc1a91a8e10e068d03e67914f59af007984f2a6512d60f2dfa261a1cddcb0a3d16079c93d11e89ffda7a3f2f80416b7f6fba2c7196a0a29891baa6098d

    • C:\Users\Admin\AppData\Local\Temp\669988e5c0864ec3089edc14043e0188f2a486ec422e26d1542dfa80ca1d919f.dll
      MD5

      ee1c304eaa7e2756b373b7db3b5c857f

      SHA1

      d36f1b6e276500b496e72ecbc4b16626923f49e1

      SHA256

      1578ff3ffe383ccfbf1766b4adde351088b3466479772fae6b8bfba2a7fb4cff

      SHA512

      f0bb3ffc1a91a8e10e068d03e67914f59af007984f2a6512d60f2dfa261a1cddcb0a3d16079c93d11e89ffda7a3f2f80416b7f6fba2c7196a0a29891baa6098d

    • memory/3636-132-0x0000000000B80000-0x0000000000FB3000-memory.dmp
      Filesize

      4.2MB

    • memory/3636-133-0x0000000000110000-0x0000000000144000-memory.dmp
      Filesize

      208KB

    • memory/3660-130-0x0000000002850000-0x0000000002A3A000-memory.dmp
      Filesize

      1.9MB

    • memory/3660-131-0x0000000010000000-0x000000001026E000-memory.dmp
      Filesize

      2.4MB