Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
13-07-2022 22:46
General
-
Target
362e56855844fb2be3dfae4b566ab676f6ec681fad1c1a2e8eb6d245d56b83f5.msi
-
Size
676KB
-
MD5
a0d132cdc67c29abf79ecf455c4a4e25
-
SHA1
2b278de35e52d695b27e1c880d35db04daa982bf
-
SHA256
362e56855844fb2be3dfae4b566ab676f6ec681fad1c1a2e8eb6d245d56b83f5
-
SHA512
645d2e3a168667de44d04756f48fe1d7d6581efc0755dccd72f6e09e603300783777b3b3376bb0d2bfab4c1ad3d239845eb606acffc3ea4ea4261d451c427ddf
Malware Config
Extracted
qakbot
403.780
vip01
1657721813
67.209.195.198:443
63.143.92.99:995
148.64.96.100:443
72.252.157.93:990
72.252.157.93:995
89.101.97.139:443
76.25.142.196:443
47.180.172.159:443
67.165.206.193:993
32.221.224.140:995
70.46.220.114:443
176.45.218.138:995
174.69.215.101:443
24.54.48.11:443
86.97.10.37:443
81.158.239.251:2078
37.34.253.233:443
120.150.218.241:995
186.90.153.162:2222
38.70.253.226:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Blocklisted process makes network request 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 54 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\362e56855844fb2be3dfae4b566ab676f6ec681fad1c1a2e8eb6d245d56b83f5.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs2⤵
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 00:49 /tn nicrwypqez /ET 01:00 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAGQAbwBiAGUARgBvAG4AdABQAGEAYwBrAFwAbQBhAGkAbgAuAGQAbABsACIA" /SC ONCE5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAGQAbwBiAGUARgBvAG4AdABQAGEAYwBrAFwAbQBhAGkAbgAuAGQAbABsACIA1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\AdobeFontPack\main.dll3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies data under HKEY_USERS
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
727B
MD58a242b0a127a02e6fc3f64b614243b36
SHA1c2d138d37c8f8ba7a32c2899de0a95aeb53819eb
SHA256ea3a5f0a6c6234215dd939266556f704718c66dd5539cef858f63e465df2df47
SHA5122c2a6ab2c0665fa75f7d880c9329b7373284a3b67152ed2718175fdd46a53c73a1007c029b464014d74ab747368c622b59ce1bc065b37d0cf2851ae8d41f779b
-
Filesize
727B
MD5f03c38eaf2e70f775a5e3f79b32f9763
SHA130f5e388bca5b15c6ef3631c0b1541a5eba22de8
SHA2565080434e11aca036882d802de0651de62b0055160338056354cc04ca29318e9d
SHA5125be3ae475fcdb1096eb287f155875209cf95419d7ad0db6cf31f9b73ea4a2ef9153a2769edc7ef870199b536b710b22b9a9b451accf5c09dec1874389909c7b8
-
Filesize
438B
MD51729cbd31b85ca6a2405d3d9f4564a75
SHA1892d283d048c3f825bb04b99630c3922e1932750
SHA256d80872bd3c6c49354aec19257e3c69a422f7f01bb467b7e141a6214e9bedc3a6
SHA512620cec48ab788dd8b8eeaf7f15298c0b1e2a04e616c9681c72f6feba160f9bdac8eb9dd093ff7b8b894797ae610fd16f59d6f59a42b1ae94f3f6a66f72cac7a9
-
Filesize
412B
MD5040a464fbc70f45c59fc6b7e0b886fc7
SHA1506ca1df406071bc40c6c113dc79549bdbf3ef8c
SHA256a0d938003c57355fa41ac41ba1557fcce7bdadc0e16d93f7827bc5918aea8935
SHA5127e4f7b22aed2108b2af475d7210ac7cac81be178b7d9b5f173870aa6cebb40a6049be869fd8c48ad0503e9e2a823b62a73ad18f6a76b1e02a91b594ab6a13276
-
Filesize
1.3MB
MD52fce945f0621e3812618f55c4a3926e9
SHA165aa7e9e33d25ee812e9ac86f45488c6c531d9ad
SHA256c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a
SHA51295a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614
-
Filesize
1.3MB
MD52fce945f0621e3812618f55c4a3926e9
SHA165aa7e9e33d25ee812e9ac86f45488c6c531d9ad
SHA256c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a
SHA51295a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614
-
Filesize
68B
MD50308aa2c8dab8a69de41f5d16679bb9b
SHA1c6827bf44a433ff086e787653361859d6f6e2fb3
SHA2560a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
SHA5121a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
-
Filesize
25.0MB
MD503f73130d2d64e02fc77159769b5de7d
SHA1afd24527d397046c65f49e94e1d9b1416a4d0bfe
SHA2563e85918aab88e7ac456798c783e1a0fbc8e001420f90a0ed62afac2554f3171f
SHA512aa91d41785cc221293377a9e1f0e23c82f07548c669657c9d12567b0610652527c56137d7706fa1616bdf430ce617f9e6e3752ec6638481e00dc54364946e5ba
-
Filesize
5KB
MD52a4bd08cbb3459301d037e8dfccc8553
SHA1a0188e41a1856d1ce3b6c8234ab0c17a352683b6
SHA25601defc814338269cb3377c0b57bf9740b544b1ddec255d6eb4dfb7e96cb34267
SHA51214f2803c187a5b65bb6413843d2f6033f048a46f3f92c12769f23ccec6660f786f3ca993e240133c456a03aa32b8e9926358c4f223716ebca4d20e4179e7615d
-
Filesize
1.3MB
MD52fce945f0621e3812618f55c4a3926e9
SHA165aa7e9e33d25ee812e9ac86f45488c6c531d9ad
SHA256c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a
SHA51295a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614
-
Filesize
1.3MB
MD52fce945f0621e3812618f55c4a3926e9
SHA165aa7e9e33d25ee812e9ac86f45488c6c531d9ad
SHA256c7dfc591c7dc5371c60bd0fb1cc7ca2c14dd630a0e7272b4fac98e8d2ee5567a
SHA51295a6c8761952b43c238094fba672c0c15d011ff0af69b5100b37a52ab9b00f355337a15787fea95bd31038a4dff5a1cdfeffa70b006849f66027dcd72f2b1614
-
Filesize
136KB
-
Filesize
1.6MB
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
136KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
-
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
136KB
-
-
Filesize
136KB
-
Filesize
472KB