Overview

overview

10

Static

static

68.msi

windows7_x64

10

68.msi

windows10-2004_x64

8

Analysis

  • max time kernel
    4294213s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    14/04/2022, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    68.msi
  • Size 955KB
  • Sample220414-tsgxmagec2
  • SHA256 2b9861436d994bee6a332cbaf71a9fd6f157089062f414207c9effe84bf556e5
  • MD5 SHA1 SHA512
Score
10/10
qakbotaa1649936926bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.573

Botnet

  • AA

Campaign

  • 1649936926

C2

  • 202.134.152.2:2222

  • 103.88.226.30:443

  • 117.248.109.38:21

  • 41.107.180.28:443

  • 179.158.105.44:443

  • 46.107.48.202:443

  • 86.98.78.51:993

  • 24.43.99.75:443

  • 39.44.144.159:995

  • 45.241.140.203:995

  • 82.152.39.39:443

  • 72.76.94.99:443

  • 66.98.42.102:443

  • 31.48.166.122:2078

  • 32.221.224.140:995

  • 31.35.28.29:443

  • 203.122.46.130:443

  • 187.207.47.198:61202

  • 196.203.37.215:80

  • 47.180.172.159:50010

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Blocklisted process makes network request 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\68.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2004
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F33386D0DBA4ADD934B2E98527150FA7
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\SysWOW64\regsvr32.exe" C:\Users\Admin\AppData\Local\SetupTest\1.dll
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aqwoyyqyr /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\SetupTest\1.dll\"" /SC ONCE /Z /ST 18:23 /ET 18:35
            5⤵
            • Creates scheduled task(s)
            PID:872
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1912
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "000000000000058C"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1036

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 727B
        • SHA256 0d01919f0f1f657cee31c474a046578edb86cb76ed80dd7b14030301340d8165
        • MD5 SHA1 SHA512
        Submit Download

        AEACCDA8653DD8D7B2EA32F21D15D44F_9D34B796E68DBC03A85BB2F7EFF46112
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_9D34B796E68DBC03A85BB2F7EFF46112
        • Size 638B
        • SHA256 c8f451e90dd0dcfa99f8ff585e58325ddf5574f7487d94efeb6e94c72041835b
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 471B
        • SHA256 8c6c7f172fd12e0ce13866a895f49fe6770fe85c58ab0ab7a2d741d2723c38a8
        • MD5 SHA1 SHA512
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 398B
        • SHA256 e4ef781cb4c03aa85caa0c17545223c08ef6fb49aff716524c5ab9c167f0869c
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 344B
        • SHA256 b4727939d34f3ca0315ee34b36eb5ec46744e67d857cb2194a899063bfc0b9c2
        • MD5 SHA1 SHA512
        Submit Download

        AEACCDA8653DD8D7B2EA32F21D15D44F_9D34B796E68DBC03A85BB2F7EFF46112
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_9D34B796E68DBC03A85BB2F7EFF46112
        • Size 394B
        • SHA256 38b8ef5ac705243f6337ef1c3b709e2198ac1dcceba81b8980a9918429859304
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 396B
        • SHA256 f7c2a9286cc97a6ea2926035fbc5e610527a20a2bbfa2bb319c15d4d57349b64
        • MD5 SHA1 SHA512
        Submit Download

        1.dll
        • Path C:\Users\Admin\AppData\Local\SetupTest\1.dll
        • Size 1.3MB
        • SHA256 f642fe6b372183af134c1c8cd5f806de37dcea27d6eab2ef53663d61795416e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1.dll
        • Path \Users\Admin\AppData\Local\SetupTest\1.dll
        • Size 1.3MB
        • SHA256 f642fe6b372183af134c1c8cd5f806de37dcea27d6eab2ef53663d61795416e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/952-76-0x0000000000110000-0x0000000000112000-memory.dmp
        Download

        memory/952-81-0x0000000000080000-0x000000000010F000-memory.dmp
        Download

        memory/952-80-0x00000000753D1000-0x00000000753D3000-memory.dmp
        Download

        memory/1252-69-0x0000000001FD0000-0x000000000212B000-memory.dmp
        Download

        memory/1252-71-0x0000000000A30000-0x0000000000ABF000-memory.dmp
        Download

        memory/1252-72-0x00000000022F0000-0x00000000023A1000-memory.dmp
        Download

        memory/1252-73-0x0000000000A30000-0x0000000000ABF000-memory.dmp
        Download

        memory/1252-75-0x0000000000A30000-0x0000000000ABF000-memory.dmp
        Download

        memory/1252-70-0x0000000000A30000-0x0000000000ABF000-memory.dmp
        Download

        memory/1728-64-0x00000000765D1000-0x00000000765D3000-memory.dmp
        Download

        memory/2004-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp
        Download