Analysis
- max time kernel
153s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
08/07/2022, 23:27
General
- Target NG2T.dll
- Size 670KB
- Sample220708-3fdh4sdaa9
- SHA256 357b994cf1840ccd15970656a2c42d5fa3491be76e08d063c9e7ca4b9c334da6
Malware Config
Extracted
-
qakbot
-
403.780
-
obama199
-
1657265474
-
121.7.223.45:2222
-
67.209.195.198:443
-
148.64.96.100:443
-
92.132.132.81:2222
-
217.128.122.65:2222
-
47.180.172.159:443
-
173.174.216.62:443
-
70.46.220.114:443
-
32.221.224.140:995
-
69.14.172.24:443
-
117.248.109.38:21
-
94.59.15.180:2222
-
38.70.253.226:2222
-
217.165.157.202:995
-
41.228.22.180:443
-
67.165.206.193:993
-
172.115.177.204:2222
-
186.90.153.162:2222
-
47.23.89.60:993
-
120.150.218.241:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Drops file in System32 directory 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 61 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NG2T.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NG2T.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 01:30 /tn sdyiypx /ET 01:41 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATgBHADIAVAAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {78AED5D2-E013-4231-9D16-65B4F49300E9} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATgBHADIAVAAuAGQAbABsACIA2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\NG2T.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\NG2T.dll4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
NG2T.dll
memory/912-55-0x00000000752B1000-0x00000000752B3000-memory.dmp
memory/912-56-0x0000000000770000-0x000000000081A000-memory.dmp
memory/912-57-0x0000000000950000-0x0000000000972000-memory.dmp
memory/912-58-0x0000000000300000-0x000000000033F000-memory.dmp
memory/912-59-0x0000000000950000-0x0000000000972000-memory.dmp
memory/912-61-0x0000000000950000-0x0000000000972000-memory.dmp
memory/912-62-0x0000000000950000-0x0000000000972000-memory.dmp
memory/912-66-0x0000000000950000-0x0000000000972000-memory.dmp
memory/1280-73-0x000007FEF2FC0000-0x000007FEF3B1D000-memory.dmp
memory/1280-78-0x0000000001094000-0x0000000001097000-memory.dmp
memory/1280-79-0x000000000109B000-0x00000000010BA000-memory.dmp
memory/1280-71-0x000007FEFB611000-0x000007FEFB613000-memory.dmp
memory/1280-72-0x000007FEF3B20000-0x000007FEF4543000-memory.dmp
memory/1280-74-0x0000000001094000-0x0000000001097000-memory.dmp
memory/1280-75-0x000000000109B000-0x00000000010BA000-memory.dmp
memory/2024-67-0x00000000000C0000-0x00000000000E2000-memory.dmp
memory/2024-69-0x00000000000C0000-0x00000000000E2000-memory.dmp
memory/2024-65-0x00000000740B1000-0x00000000740B3000-memory.dmp