Analysis

  • max time kernel
    149s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    30-06-2022 16:57

General

  • Target

    1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll

  • Size

    2.3MB

  • MD5

    24d815e6c835858db8a3877422fb78a4

  • SHA1

    702a0b6ca86d0ef65100b94632aeb4fc4c7530fb

  • SHA256

    1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4

  • SHA512

    a49c5c4ed4fda1efb2de4abb26213e791e9b8c7ebfeead1f804f2034a849e7292d292952c219627ab56bc369dbdfa5c35394c70d85c3d82e273a5856a62f8f32

Malware Config

Extracted

Family

qakbot

Version

401.157

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn exrbtmbhrt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll\"" /SC ONCE /Z /ST 17:00 /ET 17:12
          4⤵
          • Creates scheduled task(s)
          PID:828
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {5A17DD60-9A82-4E49-8FA2-EC578AEEC99D} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\system32\regsvr32.exe
      regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\SysWOW64\regsvr32.exe
        -s "C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll"
        3⤵
        • Loads dropped DLL
        PID:428

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll
    Filesize

    2.3MB

    MD5

    077e7b3b710d8ccc08a4e90d4c21b4c9

    SHA1

    4924ac9ab64d697b173b1ecef53a184ba70ccded

    SHA256

    4eedd467a4beccc054a90c192771e91fe463bc6090386aab0aa1a32de9aaef2c

    SHA512

    6604e92114d5bdbe6ca4720ec609ec2925b6b6978bcbdcd498e6ee4fcc3d240c9f4ea7e984d88d2bb9e79b34e1933d50986ba0be5f25f5cde246e1c12fedb8b3

  • \Users\Admin\AppData\Local\Temp\1386de471fc12d49554ef415d7f5fa3b092b560ce83abac470282cd24490f1d4.dll
    Filesize

    2.3MB

    MD5

    077e7b3b710d8ccc08a4e90d4c21b4c9

    SHA1

    4924ac9ab64d697b173b1ecef53a184ba70ccded

    SHA256

    4eedd467a4beccc054a90c192771e91fe463bc6090386aab0aa1a32de9aaef2c

    SHA512

    6604e92114d5bdbe6ca4720ec609ec2925b6b6978bcbdcd498e6ee4fcc3d240c9f4ea7e984d88d2bb9e79b34e1933d50986ba0be5f25f5cde246e1c12fedb8b3

  • memory/428-68-0x0000000000000000-mapping.dmp
  • memory/828-63-0x0000000000000000-mapping.dmp
  • memory/1264-65-0x0000000000000000-mapping.dmp
  • memory/1264-66-0x000007FEFB721000-0x000007FEFB723000-memory.dmp
    Filesize

    8KB

  • memory/1636-58-0x0000000000000000-mapping.dmp
  • memory/1636-60-0x0000000074411000-0x0000000074413000-memory.dmp
    Filesize

    8KB

  • memory/1636-62-0x0000000000080000-0x00000000000B4000-memory.dmp
    Filesize

    208KB

  • memory/1636-64-0x0000000000080000-0x00000000000B4000-memory.dmp
    Filesize

    208KB

  • memory/1748-57-0x0000000010000000-0x0000000010244000-memory.dmp
    Filesize

    2.3MB

  • memory/1748-61-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

  • memory/1748-54-0x0000000000000000-mapping.dmp
  • memory/1748-56-0x00000000008F0000-0x0000000000ADA000-memory.dmp
    Filesize

    1.9MB

  • memory/1748-55-0x0000000075B61000-0x0000000075B63000-memory.dmp
    Filesize

    8KB