Overview

overview

10

Static

static

39428e08fb...c6.dll

windows7-x64

10

39428e08fb...c6.dll

windows10-2004-x64

10

Resubmissions

09-01-2023 07:32

230109-jc7g8sgh7x 10

13-09-2022 13:34

220913-qt3zpsbebr 10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-01-2023 07:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll

  • Size

    389KB

  • MD5

    22c994d8334a898374532a7522f53fcb

  • SHA1

    41f02959057c81b9fc9dc57add4b52698214e335

  • SHA256

    39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6

  • SHA512

    5393a66eaa7e63408f1ac3586985c8eccf4f7d65eac603b562f407e676710ebf15e006c09b2bce1d642f1299862a1373cb9a786adb7218263d5061e2857d691b

  • SSDEEP

    12288:9zlWXAEum0intq9k7PPsVcELe8IrHpDzl/qlhgs:9zQXAEujEQu7Iu8IrHTylhg

Score
10/10
qakbotbb1663053540bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663053540

C2

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 08:35 /tn rtoetgatg /ET 08:46 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMwA5ADQAMgA4AGUAMAA4AGYAYgAxADQAZAAxADgAOAA3ADgAZAAxADQANwBmADkAMQBmADkAYwBmAGIAZAAzADIANAAzADYAYQAyAGMAMAA3AGUANgA5ADUAZQA0ADMAMwAwAGUAMwA5ADQANgA4AGIAMAA4AGMAZAAxAGMANgAuAGQAbABsACIA" /SC ONCE
          4⤵
          • Creates scheduled task(s)
          PID:3952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-132-0x0000000000000000-mapping.dmp
    Download
  • memory/1756-133-0x0000000000D40000-0x0000000000D62000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1756-135-0x0000000000D40000-0x0000000000D62000-memory.dmp
    Filesize

    136KB

    Download
  • memory/2380-134-0x0000000000000000-mapping.dmp
    Download
  • memory/2380-136-0x0000000000FD0000-0x0000000000FF2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/2380-138-0x0000000000FD0000-0x0000000000FF2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/3952-137-0x0000000000000000-mapping.dmp
    Download