Resubmissions

15-09-2022 09:32

220915-lhzqpagcdq 10

14-09-2022 17:42

220914-v93q4aahg3 10

Analysis

  • max time kernel
    1800s
  • max time network
    1802s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2022 09:32

General

  • Target

    about/butPeople.dll

  • Size

    368KB

  • MD5

    aaabcb8c5464c4fdb6d72816f77f3b65

  • SHA1

    7397d48671bde4ef13ae59f3427f0c1a1e7977d4

  • SHA256

    1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

  • SHA512

    c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

  • SSDEEP

    6144:0u8T9zrStWm3C3klS1gqbe5L05kVxVFInAPexY5ixyizO8wj+A:/8ZSg24Vbe5LFVxVFIAPWelSZm

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

obama202

Campaign

1663062752

C2

99.232.140.205:2222

41.69.118.117:995

179.111.111.88:32101

37.210.148.30:995

47.146.182.110:443

191.97.234.238:995

64.207.215.69:443

88.233.194.154:2222

81.131.161.131:2078

86.98.156.176:993

200.161.62.126:32101

88.244.84.195:443

78.100.254.17:2222

85.114.99.34:443

113.170.216.154:443

194.49.79.231:443

193.3.19.37:443

84.38.133.191:443

175.110.231.67:443

191.84.204.214:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 8 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 11:36 /tn wkrgfwut /ET 11:47 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBiAG8AdQB0AFwAYgB1AHQAUABlAG8AcABsAGUALgBkAGwAbAAiAA==" /SC ONCE
          4⤵
          • Creates scheduled task(s)
          PID:1688
        • C:\Windows\SysWOW64\net.exe
          net view
          4⤵
          • Discovers systems in the same network
          PID:1052
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c set
          4⤵
            PID:1632
          • C:\Windows\SysWOW64\arp.exe
            arp -a
            4⤵
              PID:1296
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              4⤵
              • Gathers network information
              PID:1524
            • C:\Windows\SysWOW64\nslookup.exe
              nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
              4⤵
                PID:1256
              • C:\Windows\SysWOW64\net.exe
                net share
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1280
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 share
                  5⤵
                    PID:1856
                • C:\Windows\SysWOW64\route.exe
                  route print
                  4⤵
                    PID:1784
                  • C:\Windows\SysWOW64\netstat.exe
                    netstat -nao
                    4⤵
                    • Gathers network information
                    • Suspicious use of AdjustPrivilegeToken
                    PID:804
                  • C:\Windows\SysWOW64\net.exe
                    net localgroup
                    4⤵
                      PID:1768
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 localgroup
                        5⤵
                          PID:1516
                      • C:\Windows\SysWOW64\whoami.exe
                        whoami /all
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:584
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {7F547DCF-AB6D-4DC1-A669-A53599CDC312} S-1-5-18:NT AUTHORITY\System:Service:
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:268
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBiAG8AdQB0AFwAYgB1AHQAUABlAG8AcABsAGUALgBkAGwAbAAiAA==
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:688
                    • C:\Windows\system32\regsvr32.exe
                      "C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1808
                      • C:\Windows\SysWOW64\regsvr32.exe
                        C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
                        4⤵
                        • Loads dropped DLL
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of WriteProcessMemory
                        PID:768
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:1684
                          • C:\Windows\SysWOW64\net.exe
                            net view
                            6⤵
                            • Discovers systems in the same network
                            PID:1732
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c set
                            6⤵
                              PID:1340
                            • C:\Windows\SysWOW64\arp.exe
                              arp -a
                              6⤵
                                PID:1352
                              • C:\Windows\SysWOW64\ipconfig.exe
                                ipconfig /all
                                6⤵
                                • Gathers network information
                                PID:824
                              • C:\Windows\SysWOW64\nslookup.exe
                                nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
                                6⤵
                                  PID:1824
                                • C:\Windows\SysWOW64\net.exe
                                  net share
                                  6⤵
                                    PID:1308
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 share
                                      7⤵
                                        PID:916
                                    • C:\Windows\SysWOW64\route.exe
                                      route print
                                      6⤵
                                        PID:1760
                                      • C:\Windows\SysWOW64\netstat.exe
                                        netstat -nao
                                        6⤵
                                        • Gathers network information
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1704
                                      • C:\Windows\SysWOW64\net.exe
                                        net localgroup
                                        6⤵
                                          PID:1688
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 localgroup
                                            7⤵
                                              PID:1588
                                          • C:\Windows\SysWOW64\whoami.exe
                                            whoami /all
                                            6⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1404
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1560
                                • C:\Windows\system32\taskeng.exe
                                  taskeng.exe {2ACD4B94-17B1-4963-AE5F-16E3B14B5F8E} S-1-5-18:NT AUTHORITY\System:Service:
                                  1⤵
                                    PID:1872
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBiAG8AdQB0AFwAYgB1AHQAUABlAG8AcABsAGUALgBkAGwAbAAiAA==
                                      2⤵
                                      • Drops file in System32 directory
                                      PID:1608
                                      • C:\Windows\system32\regsvr32.exe
                                        "C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
                                        3⤵
                                          PID:524
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll
                                            4⤵
                                              PID:1012

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll

                                        Filesize

                                        4KB

                                        MD5

                                        a1f33f53027e368194de1fc1f01ea640

                                        SHA1

                                        465f838638758c0634571d0c9ede0757f6a793ba

                                        SHA256

                                        a8eaafc7a33326310d17840f9545b1c25e73c9f88690baf00f9ee20d90ccb1df

                                        SHA512

                                        9013bcef8482cd696b8e24a4c0b641fd5982033df9e88a0aa5bb665a00a1933b2c44b6f8b2303e416d0d4dd2a12b25859214b23c19cecdfe9111ac362285e1b4

                                      • C:\Users\Admin\AppData\Local\Temp\about\butPeople.dll

                                        Filesize

                                        368KB

                                        MD5

                                        aaabcb8c5464c4fdb6d72816f77f3b65

                                        SHA1

                                        7397d48671bde4ef13ae59f3427f0c1a1e7977d4

                                        SHA256

                                        1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

                                        SHA512

                                        c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

                                      • \Users\Admin\AppData\Local\Temp\about\butPeople.dll

                                        Filesize

                                        368KB

                                        MD5

                                        aaabcb8c5464c4fdb6d72816f77f3b65

                                        SHA1

                                        7397d48671bde4ef13ae59f3427f0c1a1e7977d4

                                        SHA256

                                        1cbd5c3072fd99bff1408bc1f8a3b09206322de8b83b743a57efa24adefdb44f

                                        SHA512

                                        c5165a9e1f8185a94256bb67cf89d035f743e461795f0444208ee116df53bec5633673527cf52727462a8c543286c2f05f74dcc16078e5a1d2689ea434876546

                                      • memory/688-69-0x000007FEF4A00000-0x000007FEF5423000-memory.dmp

                                        Filesize

                                        10.1MB

                                      • memory/688-74-0x0000000001264000-0x0000000001267000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/688-75-0x000000000126B000-0x000000000128A000-memory.dmp

                                        Filesize

                                        124KB

                                      • memory/688-70-0x000007FEF3EA0000-0x000007FEF49FD000-memory.dmp

                                        Filesize

                                        11.4MB

                                      • memory/688-71-0x0000000001264000-0x0000000001267000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/768-80-0x00000000003A0000-0x00000000003C2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/768-82-0x00000000003A0000-0x00000000003C2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/768-86-0x00000000003A0000-0x00000000003C2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/948-63-0x0000000074D71000-0x0000000074D73000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/948-66-0x0000000000080000-0x00000000000A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/948-64-0x0000000000080000-0x00000000000A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1032-54-0x000007FEFC581000-0x000007FEFC583000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1608-119-0x000007FEF49A0000-0x000007FEF53C3000-memory.dmp

                                        Filesize

                                        10.1MB

                                      • memory/1608-124-0x0000000000B44000-0x0000000000B47000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/1608-121-0x0000000000B44000-0x0000000000B47000-memory.dmp

                                        Filesize

                                        12KB

                                      • memory/1608-120-0x000007FEF3E40000-0x000007FEF499D000-memory.dmp

                                        Filesize

                                        11.4MB

                                      • memory/1608-125-0x0000000000B4B000-0x0000000000B6A000-memory.dmp

                                        Filesize

                                        124KB

                                      • memory/1684-87-0x0000000000080000-0x00000000000A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1684-88-0x0000000000080000-0x00000000000A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1788-59-0x0000000000140000-0x00000000001C0000-memory.dmp

                                        Filesize

                                        512KB

                                      • memory/1788-60-0x0000000000140000-0x00000000001C0000-memory.dmp

                                        Filesize

                                        512KB

                                      • memory/1788-57-0x0000000000150000-0x0000000000172000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1788-56-0x0000000076711000-0x0000000076713000-memory.dmp

                                        Filesize

                                        8KB