Analysis

  • max time kernel
    4294225s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    19-03-2022 16:56

General

  • Target

    3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll

  • Size

    2.5MB

  • MD5

    dfbe0bb4bbd9f7c9b125bdb82412f7d5

  • SHA1

    37e788de8af9b030117c0ce838ab88896d24af0b

  • SHA256

    3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624

  • SHA512

    3f255968c5581e24c25556ad1fce0d4726dc392f240bb6eab55f46ffa2d2f66397b5dd75fe4c4b43615266762f397015b922005d76e1149892504f9a870f7827

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gsuuvhs /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll\"" /SC ONCE /Z /ST 01:34 /ET 01:46
          4⤵
          • Creates scheduled task(s)
          PID:1932
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0FE43C6B-053A-4580-96F7-BCB89FF8D997} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll"
        3⤵
          PID:1240

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3802340000846fb84b9dd525a0ed65a49c0ee2582419e2cd7a387d7f252fb624.dll
      MD5

      bb979ba0fe5008fb8e75c88ee0c15be7

      SHA1

      2f138fdbd696e8290ea26890e9098bcf351ec079

      SHA256

      30bf6ebbccde91746c3d07ea52564cf65901774460b18a41e013bec688a0c6e9

      SHA512

      fb166c2945ff67558c1e544c3a06748f8ada1120bc4ca59d947bb8d8f65df6a63c94596cc25e0bc142e72355bfc7fcb90df364b23ea3c21548d9e93cbd47bcf7

    • memory/744-57-0x0000000000140000-0x0000000000142000-memory.dmp
      Filesize

      8KB

    • memory/744-60-0x0000000074751000-0x0000000074753000-memory.dmp
      Filesize

      8KB

    • memory/744-61-0x0000000000E90000-0x0000000001111000-memory.dmp
      Filesize

      2.5MB

    • memory/744-62-0x00000000000C0000-0x00000000000F4000-memory.dmp
      Filesize

      208KB

    • memory/964-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
      Filesize

      8KB

    • memory/964-55-0x00000000020C0000-0x00000000022AA000-memory.dmp
      Filesize

      1.9MB

    • memory/964-56-0x0000000010000000-0x000000001028A000-memory.dmp
      Filesize

      2.5MB

    • memory/1236-63-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp
      Filesize

      8KB