Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-07-2022 19:42
General
-
Target
102755.dll
-
Size
686KB
-
MD5
03b4779695d01b1d9e2178a4b2308418
-
SHA1
bb673af6c22c1712670477c20b35127c76d141e2
-
SHA256
7bad50b94eb8142e6ba3b68116f0d3f185582e1e2661085040c37b0f21dc6a85
-
SHA512
02303e4f88d3156176ef762c31329e2bd34234be7ef1fab857f37a0f623fc590e579826d3513d64b07926c5e55bacb3b888354fc2a9c66a7e00f4f921576a48b
Malware Config
Extracted
qakbot
403.780
obama200
1657548298
172.115.177.204:2222
89.101.97.139:443
186.90.153.162:2222
38.70.253.226:2222
120.150.218.241:995
72.252.157.93:995
72.252.157.93:993
94.36.193.176:2222
47.23.89.60:993
89.211.209.234:2222
76.25.142.196:443
46.100.25.239:61202
24.158.23.166:995
69.14.172.24:443
92.132.132.81:2222
37.34.253.233:443
93.48.80.198:995
174.80.15.101:2083
24.178.196.158:2222
197.89.20.137:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\102755.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\102755.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 21:48 /tn pqyxgpoof /ET 21:59 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADIANwA1ADUALgBkAGwAbAAiAA==" /SC ONCE4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {5DD19E8C-1D5D-4020-AD86-185F4968459D} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADIANwA1ADUALgBkAGwAbAAiAA==2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\102755.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\102755.dll4⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\102755.dllFilesize
686KB
MD503b4779695d01b1d9e2178a4b2308418
SHA1bb673af6c22c1712670477c20b35127c76d141e2
SHA2567bad50b94eb8142e6ba3b68116f0d3f185582e1e2661085040c37b0f21dc6a85
SHA51202303e4f88d3156176ef762c31329e2bd34234be7ef1fab857f37a0f623fc590e579826d3513d64b07926c5e55bacb3b888354fc2a9c66a7e00f4f921576a48b
-
\Users\Admin\AppData\Local\Temp\102755.dllFilesize
686KB
MD503b4779695d01b1d9e2178a4b2308418
SHA1bb673af6c22c1712670477c20b35127c76d141e2
SHA2567bad50b94eb8142e6ba3b68116f0d3f185582e1e2661085040c37b0f21dc6a85
SHA51202303e4f88d3156176ef762c31329e2bd34234be7ef1fab857f37a0f623fc590e579826d3513d64b07926c5e55bacb3b888354fc2a9c66a7e00f4f921576a48b
-
memory/320-86-0x0000000000300000-0x0000000000322000-memory.dmpFilesize
136KB
-
memory/320-87-0x0000000000260000-0x000000000029F000-memory.dmpFilesize
252KB
-
memory/320-80-0x0000000000000000-mapping.dmp
-
memory/320-83-0x0000000000520000-0x00000000005CE000-memory.dmpFilesize
696KB
-
memory/320-84-0x0000000000300000-0x0000000000322000-memory.dmpFilesize
136KB
-
memory/320-85-0x0000000000300000-0x0000000000322000-memory.dmpFilesize
136KB
-
memory/320-88-0x0000000000300000-0x0000000000322000-memory.dmpFilesize
136KB
-
memory/556-60-0x00000000003D0000-0x000000000040F000-memory.dmpFilesize
252KB
-
memory/556-65-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/556-61-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/556-56-0x0000000000240000-0x00000000002EE000-memory.dmpFilesize
696KB
-
memory/556-57-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/556-58-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/556-55-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/556-54-0x0000000000000000-mapping.dmp
-
memory/556-59-0x0000000000410000-0x0000000000432000-memory.dmpFilesize
136KB
-
memory/688-71-0x000007FEF4A90000-0x000007FEF54B3000-memory.dmpFilesize
10.1MB
-
memory/688-70-0x000007FEFC451000-0x000007FEFC453000-memory.dmpFilesize
8KB
-
memory/688-69-0x0000000000000000-mapping.dmp
-
memory/688-77-0x0000000001214000-0x0000000001217000-memory.dmpFilesize
12KB
-
memory/688-78-0x000000000121B000-0x000000000123A000-memory.dmpFilesize
124KB
-
memory/688-73-0x0000000001214000-0x0000000001217000-memory.dmpFilesize
12KB
-
memory/688-72-0x000007FEF3F30000-0x000007FEF4A8D000-memory.dmpFilesize
11.4MB
-
memory/688-74-0x000000000121B000-0x000000000123A000-memory.dmpFilesize
124KB
-
memory/1248-67-0x0000000000000000-mapping.dmp
-
memory/1688-75-0x0000000000000000-mapping.dmp
-
memory/2024-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/2024-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/2024-64-0x0000000074F71000-0x0000000074F73000-memory.dmpFilesize
8KB
-
memory/2024-62-0x0000000000000000-mapping.dmp