Analysis

  • max time kernel
    4294211s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    08-04-2022 19:00

General

  • Target

    0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll

  • Size

    1.7MB

  • MD5

    94faab5bb36e576d46c1466e820b9fdd

  • SHA1

    6488a57a83b8342c8c544eecc7cebe82e3213f93

  • SHA256

    0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

  • SHA512

    14614ae97be5bb36c5981d293e265fe7a73e32521da34e23f72cb715337f22e95ffd2826a20ecaa522dbf418ae6ccfaa4713b6f2f2e60e04222d998f68db3520

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Windows security bypass 2 TTPs
  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wcotfuwzr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll\"" /SC ONCE /Z /ST 21:02 /ET 21:14
          4⤵
          • Creates scheduled task(s)
          PID:1108
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {B3185753-4C91-4C3E-BE40-1F0D63512DAF} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:524
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ceelifankf" /d "0"
            5⤵
              PID:736
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eejypxxyifmu" /d "0"
              5⤵
                PID:1016

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Disabling Security Tools

      1
      T1089

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll
        Filesize

        1.7MB

        MD5

        94faab5bb36e576d46c1466e820b9fdd

        SHA1

        6488a57a83b8342c8c544eecc7cebe82e3213f93

        SHA256

        0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

        SHA512

        14614ae97be5bb36c5981d293e265fe7a73e32521da34e23f72cb715337f22e95ffd2826a20ecaa522dbf418ae6ccfaa4713b6f2f2e60e04222d998f68db3520

      • \Users\Admin\AppData\Local\Temp\0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8.dll
        Filesize

        1.7MB

        MD5

        94faab5bb36e576d46c1466e820b9fdd

        SHA1

        6488a57a83b8342c8c544eecc7cebe82e3213f93

        SHA256

        0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

        SHA512

        14614ae97be5bb36c5981d293e265fe7a73e32521da34e23f72cb715337f22e95ffd2826a20ecaa522dbf418ae6ccfaa4713b6f2f2e60e04222d998f68db3520

      • memory/524-90-0x0000000000100000-0x000000000018F000-memory.dmp
        Filesize

        572KB

      • memory/524-85-0x0000000000000000-mapping.dmp
      • memory/736-88-0x0000000000000000-mapping.dmp
      • memory/1016-89-0x0000000000000000-mapping.dmp
      • memory/1108-68-0x0000000000000000-mapping.dmp
      • memory/1124-63-0x0000000000150000-0x0000000000152000-memory.dmp
        Filesize

        8KB

      • memory/1124-65-0x0000000000000000-mapping.dmp
      • memory/1124-67-0x00000000741F1000-0x00000000741F3000-memory.dmp
        Filesize

        8KB

      • memory/1124-69-0x0000000000080000-0x000000000010F000-memory.dmp
        Filesize

        572KB

      • memory/1524-80-0x0000000000DE0000-0x0000000000E6F000-memory.dmp
        Filesize

        572KB

      • memory/1524-79-0x0000000000DE0000-0x0000000000E6F000-memory.dmp
        Filesize

        572KB

      • memory/1524-76-0x0000000000A80000-0x0000000000C2E000-memory.dmp
        Filesize

        1.7MB

      • memory/1524-77-0x0000000000DE0000-0x0000000000E6F000-memory.dmp
        Filesize

        572KB

      • memory/1524-78-0x0000000000DE0000-0x0000000000E6F000-memory.dmp
        Filesize

        572KB

      • memory/1524-81-0x0000000000990000-0x0000000000A1B000-memory.dmp
        Filesize

        556KB

      • memory/1524-73-0x0000000000000000-mapping.dmp
      • memory/1524-82-0x0000000000DE0000-0x0000000000E6F000-memory.dmp
        Filesize

        572KB

      • memory/1624-61-0x0000000001E50000-0x0000000001EDB000-memory.dmp
        Filesize

        556KB

      • memory/1624-62-0x00000000021D0000-0x000000000225F000-memory.dmp
        Filesize

        572KB

      • memory/1624-54-0x0000000000000000-mapping.dmp
      • memory/1624-60-0x00000000021D0000-0x000000000225F000-memory.dmp
        Filesize

        572KB

      • memory/1624-59-0x00000000021D0000-0x000000000225F000-memory.dmp
        Filesize

        572KB

      • memory/1624-58-0x00000000021D0000-0x000000000225F000-memory.dmp
        Filesize

        572KB

      • memory/1624-57-0x00000000021D0000-0x000000000225F000-memory.dmp
        Filesize

        572KB

      • memory/1624-56-0x0000000001F90000-0x000000000213E000-memory.dmp
        Filesize

        1.7MB

      • memory/1624-55-0x0000000075421000-0x0000000075423000-memory.dmp
        Filesize

        8KB

      • memory/1844-71-0x000007FEFB581000-0x000007FEFB583000-memory.dmp
        Filesize

        8KB

      • memory/1844-70-0x0000000000000000-mapping.dmp