Analysis
-
max time kernel
12s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
10-08-2022 16:55
General
-
Target
fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll
-
Size
991KB
-
MD5
abef3d50aa29812cd8fb7ba18279c9e9
-
SHA1
734d5fe16bb8570b755c0e44d48fb5e6f0d59fc6
-
SHA256
fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309
-
SHA512
d007749632e510f11cbb5aebf6507a48ffc555729fcdf83c114008b8cf3b160780a0dbf5022a1dabc0fe608e6c0686528fa64f16e6e8bc31f06d0857129cb4a4
Malware Config
Extracted
qakbot
402.388
tr
1635953596
190.73.3.148:2222
109.177.30.138:995
181.99.138.132:465
109.228.255.59:443
94.200.181.154:443
103.150.40.76:995
216.238.71.31:443
216.238.72.121:443
216.238.72.121:995
216.238.71.31:995
177.172.5.228:995
201.172.31.95:80
67.165.206.193:993
50.194.160.233:32100
92.59.35.196:2222
89.101.97.139:443
176.35.109.202:2222
140.82.49.12:443
109.133.93.127:995
71.13.93.154:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pqcptbidvc /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll\"" /SC ONCE /Z /ST 16:58 /ET 17:104⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {9C00456F-C101-4789-BD03-7DAE05072A0B} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dllFilesize
991KB
MD5abef3d50aa29812cd8fb7ba18279c9e9
SHA1734d5fe16bb8570b755c0e44d48fb5e6f0d59fc6
SHA256fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309
SHA512d007749632e510f11cbb5aebf6507a48ffc555729fcdf83c114008b8cf3b160780a0dbf5022a1dabc0fe608e6c0686528fa64f16e6e8bc31f06d0857129cb4a4
-
\Users\Admin\AppData\Local\Temp\fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309.dllFilesize
991KB
MD5abef3d50aa29812cd8fb7ba18279c9e9
SHA1734d5fe16bb8570b755c0e44d48fb5e6f0d59fc6
SHA256fae3a4ec87cc7f10286ed3877540a5a3de90a77400b52bc3e91a26a8204db309
SHA512d007749632e510f11cbb5aebf6507a48ffc555729fcdf83c114008b8cf3b160780a0dbf5022a1dabc0fe608e6c0686528fa64f16e6e8bc31f06d0857129cb4a4
-
memory/1000-64-0x00000000000D0000-0x0000000000104000-memory.dmpFilesize
208KB
-
memory/1000-58-0x0000000000000000-mapping.dmp
-
memory/1000-60-0x00000000741A1000-0x00000000741A3000-memory.dmpFilesize
8KB
-
memory/1000-61-0x00000000000D0000-0x0000000000104000-memory.dmpFilesize
208KB
-
memory/1184-68-0x0000000000000000-mapping.dmp
-
memory/1316-65-0x0000000000000000-mapping.dmp
-
memory/1736-63-0x0000000000000000-mapping.dmp
-
memory/1756-57-0x0000000010000000-0x00000000100FE000-memory.dmpFilesize
1016KB
-
memory/1756-62-0x0000000010000000-0x00000000100FE000-memory.dmpFilesize
1016KB
-
memory/1756-56-0x0000000074F41000-0x0000000074F43000-memory.dmpFilesize
8KB
-
memory/1756-55-0x0000000000000000-mapping.dmp
-
memory/1848-54-0x000007FEFB7A1000-0x000007FEFB7A3000-memory.dmpFilesize
8KB