Analysis
- max time kernel
150s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
09/04/2022, 19:00
General
- Target 423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll
- Size 1.7MB
- Sample220409-xnmtvsbfb3
- SHA256 423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5
Malware Config
Extracted
-
qakbot
-
403.573
-
AA
-
1649273304
-
83.110.75.97:2222
-
47.23.89.62:993
-
187.207.48.194:61202
-
45.63.1.12:995
-
140.82.63.183:995
-
45.76.167.26:995
-
140.82.63.183:443
-
144.202.2.175:995
-
144.202.3.39:443
-
149.28.238.199:443
-
144.202.3.39:995
-
45.63.1.12:443
-
149.28.238.199:995
-
45.76.167.26:443
-
144.202.2.175:443
-
100.1.108.246:443
-
32.221.224.140:995
-
24.55.67.176:443
-
31.35.28.29:443
-
70.51.134.168:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Loads dropped DLL 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tbnsueqfx /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll\"" /SC ONCE /Z /ST 21:02 /ET 21:144⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5A7ABBC2-480C-4672-81AF-ABB9A06DED33} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll
423f95a37d184c211ae0253eacf6506557a390a920d566eff1949f0503df11e5.dll
memory/848-82-0x0000000001170000-0x00000000011FF000-memory.dmp
memory/848-81-0x0000000000930000-0x00000000009BB000-memory.dmp
memory/848-80-0x0000000001170000-0x00000000011FF000-memory.dmp
memory/848-79-0x0000000001170000-0x00000000011FF000-memory.dmp
memory/848-78-0x0000000001170000-0x00000000011FF000-memory.dmp
memory/848-77-0x0000000001170000-0x00000000011FF000-memory.dmp
memory/848-76-0x0000000000B50000-0x0000000000CFE000-memory.dmp
memory/1588-71-0x000007FEFC4C1000-0x000007FEFC4C3000-memory.dmp
memory/1840-60-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/1840-57-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/1840-55-0x00000000759C1000-0x00000000759C3000-memory.dmp
memory/1840-56-0x0000000001E80000-0x000000000202E000-memory.dmp
memory/1840-58-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/1840-59-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/1840-62-0x00000000023B0000-0x000000000243F000-memory.dmp
memory/1840-61-0x0000000000310000-0x000000000039B000-memory.dmp
memory/2028-63-0x0000000000110000-0x0000000000112000-memory.dmp
memory/2028-67-0x0000000075121000-0x0000000075123000-memory.dmp
memory/2028-68-0x0000000000080000-0x000000000010F000-memory.dmp