Analysis

  • max time kernel
    149s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-06-2022 17:21

General

  • Target

    keepingitreal.dll

  • Size

    335KB

  • MD5

    0826eb256c88326e3cf600c4b4599692

  • SHA1

    ff219c09dfda55705dd10edc3532ff5937639a98

  • SHA256

    31cbe636cc468d93f6cf7e2f53cea08786045003197db953dfc760b8e981ff36

  • SHA512

    0afae206cba945a41679f39295ec522678a993bed0b973acc60e8977a17abf7b8914b6a4e765fa4fa359394337a8fdcd3cf2289e5747f5f5ff064c93bd496edb

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama192

Campaign

1655969261

C2

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

1.161.124.241:443

70.46.220.114:443

24.43.99.75:443

32.221.224.140:995

80.11.74.81:2222

31.215.184.140:2222

39.49.85.29:995

67.209.195.198:443

186.90.153.162:2222

148.64.96.100:443

67.165.206.193:993

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\keepingitreal.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\keepingitreal.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:336
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1776
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 19:23 /tn tnxptwo /ET 19:34 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAawBlAGUAcABpAG4AZwBpAHQAcgBlAGEAbAAuAGQAbABsACIA" /SC ONCE
          4⤵
          • Creates scheduled task(s)
          PID:1236
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {59B67502-0948-4D04-9FFC-10C699A95A89} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAawBlAGUAcABpAG4AZwBpAHQAcgBlAGEAbAAuAGQAbABsACIA
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\keepingitreal.dll
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Users\Admin\AppData\Local\Temp\keepingitreal.dll
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\keepingitreal.dll
    Filesize

    335KB

    MD5

    0826eb256c88326e3cf600c4b4599692

    SHA1

    ff219c09dfda55705dd10edc3532ff5937639a98

    SHA256

    31cbe636cc468d93f6cf7e2f53cea08786045003197db953dfc760b8e981ff36

    SHA512

    0afae206cba945a41679f39295ec522678a993bed0b973acc60e8977a17abf7b8914b6a4e765fa4fa359394337a8fdcd3cf2289e5747f5f5ff064c93bd496edb

  • \Users\Admin\AppData\Local\Temp\keepingitreal.dll
    Filesize

    335KB

    MD5

    0826eb256c88326e3cf600c4b4599692

    SHA1

    ff219c09dfda55705dd10edc3532ff5937639a98

    SHA256

    31cbe636cc468d93f6cf7e2f53cea08786045003197db953dfc760b8e981ff36

    SHA512

    0afae206cba945a41679f39295ec522678a993bed0b973acc60e8977a17abf7b8914b6a4e765fa4fa359394337a8fdcd3cf2289e5747f5f5ff064c93bd496edb

  • memory/336-55-0x0000000000000000-mapping.dmp
  • memory/336-56-0x0000000075711000-0x0000000075713000-memory.dmp
    Filesize

    8KB

  • memory/336-57-0x0000000000180000-0x00000000001A2000-memory.dmp
    Filesize

    136KB

  • memory/336-59-0x0000000000180000-0x0000000000200000-memory.dmp
    Filesize

    512KB

  • memory/336-63-0x0000000000180000-0x00000000001A2000-memory.dmp
    Filesize

    136KB

  • memory/1236-65-0x0000000000000000-mapping.dmp
  • memory/1720-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp
    Filesize

    8KB

  • memory/1728-72-0x0000000000000000-mapping.dmp
  • memory/1776-60-0x0000000000000000-mapping.dmp
  • memory/1776-66-0x0000000000080000-0x00000000000A2000-memory.dmp
    Filesize

    136KB

  • memory/1776-64-0x0000000000080000-0x00000000000A2000-memory.dmp
    Filesize

    136KB

  • memory/1776-62-0x0000000074091000-0x0000000074093000-memory.dmp
    Filesize

    8KB

  • memory/1924-67-0x0000000000000000-mapping.dmp
  • memory/1924-69-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp
    Filesize

    10.1MB

  • memory/1924-71-0x0000000000E74000-0x0000000000E77000-memory.dmp
    Filesize

    12KB

  • memory/1924-70-0x000007FEF3200000-0x000007FEF3D5D000-memory.dmp
    Filesize

    11.4MB

  • memory/1924-73-0x0000000000E74000-0x0000000000E77000-memory.dmp
    Filesize

    12KB

  • memory/1924-74-0x0000000000E7B000-0x0000000000E9A000-memory.dmp
    Filesize

    124KB

  • memory/1964-77-0x0000000000000000-mapping.dmp
  • memory/1964-80-0x00000000001C0000-0x00000000001E2000-memory.dmp
    Filesize

    136KB

  • memory/1964-82-0x00000000001C0000-0x00000000001E2000-memory.dmp
    Filesize

    136KB