Resubmissions

05-12-2022 21:51

221205-1qkdasag75 10

05-12-2022 21:06

221205-zx2qgsah5z 10

Analysis

  • max time kernel
    1800s
  • max time network
    1793s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2022 21:51

General

  • Target

    c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad.msi

  • Size

    597KB

  • MD5

    13bd4a09264d6312d957d61d64e79f53

  • SHA1

    5ebf19ba1be83ad9e15991e76e509a57aaa9e9c0

  • SHA256

    c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad

  • SHA512

    b7943be0b78a7de293b19e2b75a6b44bae34997c555e1a83a0064087d828616e601cc04cb8f13e6e44e8b9cb67fe2328b3826c8d31edf8cd5a74e9def710e582

  • SSDEEP

    12288:rZzDzxF3RR3sSRogrrYW4OH5IBwBZ3TzChsL4o1U:rZzDzvvRoCBH2WBJChsMo1U

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649749884

C2

120.150.218.241:995

186.64.67.38:443

196.203.37.215:80

1.161.71.109:443

82.152.39.39:443

76.69.155.202:2222

72.66.116.235:995

103.107.113.120:443

113.11.89.165:995

208.107.221.224:443

103.88.226.30:443

75.99.168.194:443

75.113.214.234:2222

76.169.147.192:32103

190.73.3.148:2222

39.52.2.90:995

38.70.253.226:2222

5.95.58.211:2087

74.15.2.252:2222

76.70.9.169:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1688
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1900
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 96613FD6F618EFDD6FBA294150CEBC8B
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe" C:\Users\Admin\AppData\Local\SetupTest\1.dll
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:568
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3544

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
      Filesize

      765B

      MD5

      6af6b6f4ae6196f189dddbc3359153d0

      SHA1

      a6b8bcd8d52bc78e6ab09a4691eb235bc342da76

      SHA256

      56843ed6f900a0b68969b73463c867953773db38d9070ad3f3bc9f17019199e4

      SHA512

      3ceab49c2e2ed4103e34f9174c69931dba4fd85442084ce37d7bd6bd829068e023f8dcba5f5cdc6c9f5633ab549d481cb322252b75ffd58ae316c273e70888e0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_D2D3A37B25AAA89445E8EFE144391472
      Filesize

      637B

      MD5

      f65e6919f241c149d42e36d0e6751e12

      SHA1

      ed0f88a86d27ab339f1b5ac02dd8a01fdd969a0e

      SHA256

      6e31167e7da0fc7f95061a6ba9201fe52bcaf0e58bca6b22d3d2be857fff1a69

      SHA512

      3b02e7a213b3f625c942ec818a53dcb2c08916b3820991256d9c8168b9cccfa4193019e410ddae30ce52c1afacb3068421da1c0ffa506709673871a263c1bdfb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
      Filesize

      1KB

      MD5

      c2e74c923e71f2331e4ac3e559feed88

      SHA1

      0dafbf3c9b11edb7a0c7d149f545b88004a951f8

      SHA256

      e2d1f43e63c1fda37b1c26cbeac110ad9edd19f6e3b337b616d57a6c0cb0c54c

      SHA512

      7ee607f0f947a04137c3849697ad5b8ca70b142d2cca8520c7b1f29e009369aff67528ccc01f8a64909bc250dbfcfbf7cbe3a42625a6320196f2f5b253ac9e71

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
      Filesize

      484B

      MD5

      a553422bd1e6e9ad02458afd44e77e24

      SHA1

      e1aef3204cc2aae18e6e831d349d399402d4025a

      SHA256

      b85c7217ee92494bcc15ce77ef84a09f8aa3ca572b90890d1bf8f29447ebcbca

      SHA512

      89fa0d8c606b211db5622cf35531454bc9958eb9e51932579004ed784998a94ceb0ff1f1bb65d76eddade841cb6e557a738eecec4c15d8c6c633730d542e259e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_D2D3A37B25AAA89445E8EFE144391472
      Filesize

      488B

      MD5

      4d878f3542ba11b522407cb697798ba1

      SHA1

      5ebd54787676b1481d7844f3db53641085a89d46

      SHA256

      154700e1c9dd78cc60384a4125508a2f7aa71576f741e3e51c821321cedb5432

      SHA512

      f87409c808df4efe9694c4de44777fb1fac6422400cf93182a5d037611e2750078342a4ae3990e86811dffa8c381cab60ad6d48f6e320d5d978501bc864d5571

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
      Filesize

      482B

      MD5

      2024ed11be7298fc4957ecf3856bc1e2

      SHA1

      abc0d9143c5dbbfd755d5f4e3981a4ec3aef2981

      SHA256

      979f30646d82e57e6c5364565aad087e3f22256452d95d6f68715e919e750cd6

      SHA512

      72038ec3049dd526a8d6a31e792682c3e23e53a53a361a1533eeadbf8b4fb2b77347700e6a1914fad2c5b4b0bd3be820d7893041fa7adc33745156e94a887681

    • C:\Users\Admin\AppData\Local\SetupTest\1.dll
      Filesize

      716KB

      MD5

      726a41b2959768c5c3d2c7c213e6d0d8

      SHA1

      e28186bc0d771d20527b5f80757f4ee3f0ce442e

      SHA256

      6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647

      SHA512

      4c349bc12d66be7abde0af38491ce082a9e13036db882bfaeff3ee6ede650c070b1c0f73bea18ae75d7eaff457436a04f0467d50c45c077162e63487cb5a7f34

    • C:\Users\Admin\AppData\Local\SetupTest\1.dll
      Filesize

      716KB

      MD5

      726a41b2959768c5c3d2c7c213e6d0d8

      SHA1

      e28186bc0d771d20527b5f80757f4ee3f0ce442e

      SHA256

      6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647

      SHA512

      4c349bc12d66be7abde0af38491ce082a9e13036db882bfaeff3ee6ede650c070b1c0f73bea18ae75d7eaff457436a04f0467d50c45c077162e63487cb5a7f34

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      11.8MB

      MD5

      e3feacf2c67bd1a1b01d2bcda8d13b85

      SHA1

      837818db5bfc735b4b45d2ade4fad1085523dc34

      SHA256

      46afe6e9ad6c1a417ffd330c4210cc0c6cf283ba3e8b945ad804fca345c2b779

      SHA512

      fcb591effcc500ca0da11859b426e8c61b28724e7827c654e800e327b89ec8b993eea4bc1bbe9289ed89fe9de8ff813b8ac4bfb953c2707839b79efe22070b4b

    • \??\Volume{2339e045-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{379916b9-a0eb-4bec-9812-720ce6c2ae18}_OnDiskSnapshotProp
      Filesize

      5KB

      MD5

      300235188255e782e0d7635064dbbea0

      SHA1

      03381777b2c646a7964a8550ffe7b39410d79ec3

      SHA256

      21fb7c33ca8e9df0d67f99cb6be4df09b104acf6afb61f0f4b10dbe6b621bc22

      SHA512

      b4d2207f6a0f61604c8d7270a1856850f08ff5d49e05b622fe983ed8d14001a0afb1682ba45ff928d254bc7e8a5df7ee09da347c364d302ac647ea8dfe8f2112

    • memory/568-151-0x0000000000000000-mapping.dmp
    • memory/568-152-0x00000000012A0000-0x000000000132F000-memory.dmp
      Filesize

      572KB

    • memory/568-153-0x00000000012A0000-0x000000000132F000-memory.dmp
      Filesize

      572KB

    • memory/1900-132-0x0000000000000000-mapping.dmp
    • memory/3448-140-0x0000000000000000-mapping.dmp
    • memory/3448-145-0x0000000010000000-0x000000001008F000-memory.dmp
      Filesize

      572KB

    • memory/4380-139-0x0000000000000000-mapping.dmp