Analysis
- max time kernel
152s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
08/07/2022, 23:27
General
- Target V0YE.dll
- Size 670KB
- Sample220708-3fdh4saebp
- SHA256 5d62cbd1c137333a510d67a26d86ef27a0230a421f25516cfcb6df49cc91c953
Malware Config
Extracted
-
qakbot
-
403.780
-
obama199
-
1657265474
-
121.7.223.45:2222
-
67.209.195.198:443
-
148.64.96.100:443
-
92.132.132.81:2222
-
217.128.122.65:2222
-
47.180.172.159:443
-
173.174.216.62:443
-
70.46.220.114:443
-
32.221.224.140:995
-
69.14.172.24:443
-
117.248.109.38:21
-
94.59.15.180:2222
-
38.70.253.226:2222
-
217.165.157.202:995
-
41.228.22.180:443
-
67.165.206.193:993
-
172.115.177.204:2222
-
186.90.153.162:2222
-
47.23.89.60:993
-
120.150.218.241:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Drops file in System32 directory 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\V0YE.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\V0YE.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 01:30 /tn vevekvls /ET 01:41 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVgAwAFkARQAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D66D6B2B-63D3-4226-BC47-EF103435F9FB} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVgAwAFkARQAuAGQAbABsACIA2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\V0YE.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\V0YE.dll4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
V0YE.dll
memory/1140-79-0x0000000000F9B000-0x0000000000FBA000-memory.dmp
memory/1140-78-0x0000000000F94000-0x0000000000F97000-memory.dmp
memory/1140-75-0x0000000000F9B000-0x0000000000FBA000-memory.dmp
memory/1140-74-0x0000000000F94000-0x0000000000F97000-memory.dmp
memory/1140-73-0x000007FEF35F0000-0x000007FEF414D000-memory.dmp
memory/1140-72-0x000007FEF4150000-0x000007FEF4B73000-memory.dmp
memory/1140-71-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp
memory/1996-65-0x00000000745D1000-0x00000000745D3000-memory.dmp
memory/1996-69-0x0000000000080000-0x00000000000A2000-memory.dmp
memory/1996-67-0x0000000000080000-0x00000000000A2000-memory.dmp
memory/2016-62-0x0000000000890000-0x00000000008B2000-memory.dmp
memory/2016-66-0x0000000000890000-0x00000000008B2000-memory.dmp
memory/2016-61-0x0000000000890000-0x00000000008B2000-memory.dmp
memory/2016-59-0x0000000000890000-0x00000000008B2000-memory.dmp
memory/2016-58-0x00000000007E0000-0x000000000081F000-memory.dmp
memory/2016-57-0x0000000000890000-0x00000000008B2000-memory.dmp
memory/2016-56-0x0000000000730000-0x00000000007DA000-memory.dmp
memory/2016-55-0x00000000763E1000-0x00000000763E3000-memory.dmp