Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2023, 10:28

General

  • Target

    fbe95e4d58b31a15569d3e4ab057bc47abb193c9afacdda186be51b2c1ac582b.msi

  • Size

    384KB

  • MD5

    bd0ebd840439189cc64af2d0cd0dd130

  • SHA1

    72cef301ca25db6f1aa42f9380ab12ae2e99a725

  • SHA256

    fbe95e4d58b31a15569d3e4ab057bc47abb193c9afacdda186be51b2c1ac582b

  • SHA512

    b6298e66cb903d58b0877a0fe9725a6fb35dc2a304a5d79532d2cbc20ee3d85667fab7cc305baf5c9b612bfed9026f54a9371de72d00eb22964fcc9ff91f9b2b

  • SSDEEP

    6144:Vn1X0lyS6gYhkJceU2iXT+XYhwNabhXx3r6FiNhRfpwt+42OTTF:V1Xw6gzJceU2khmOC4Nhxpwc6X

Malware Config

Extracted

Family

qakbot

Version

404.430

Botnet

BB12

Campaign

1675090602

C2

24.9.220.167:443

92.239.81.124:443

12.172.173.82:32101

162.248.14.107:443

213.31.90.183:2222

217.128.200.114:2222

71.31.101.183:443

81.229.117.95:2222

184.68.116.146:2222

86.130.9.183:2222

92.154.45.81:2222

70.64.77.115:443

24.71.120.191:443

86.225.214.138:2222

86.165.225.227:2222

172.90.139.138:2222

92.207.132.174:2222

70.160.80.210:443

58.162.223.233:443

47.61.70.188:2078

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fbe95e4d58b31a15569d3e4ab057bc47abb193c9afacdda186be51b2c1ac582b.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1300
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4824
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\TeamViewer\main.dll,Updt
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4680
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\TeamViewer\main.dll,Updt
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            4⤵
              PID:4092
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:808
        • C:\Windows\system32\wscript.exe
          wscript.exe C:\Users\Admin\AppData\Local\TeamViewer\notify.vbs
          2⤵
            PID:2664
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2632

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\TeamViewer\main.dll

          Filesize

          594KB

          MD5

          84ad21a10cef3176d5a1604f28adeb3c

          SHA1

          72efd8d98e6a8ffb3a45d07796bbf794b5c8795d

          SHA256

          5ab4fc385b86f965460682420dc45b840225b2b0db16b38e8e6a0c54965d91c2

          SHA512

          469be94d72fc09f453acdc024fd3aa1dc691e5930ec70f592460f1f1e90f3e2742079896ecd7fb353eb5e5fc77f9b4be3aec3119455d5e883381858b9d608cab

        • C:\Users\Admin\AppData\Local\TeamViewer\main.dll

          Filesize

          594KB

          MD5

          84ad21a10cef3176d5a1604f28adeb3c

          SHA1

          72efd8d98e6a8ffb3a45d07796bbf794b5c8795d

          SHA256

          5ab4fc385b86f965460682420dc45b840225b2b0db16b38e8e6a0c54965d91c2

          SHA512

          469be94d72fc09f453acdc024fd3aa1dc691e5930ec70f592460f1f1e90f3e2742079896ecd7fb353eb5e5fc77f9b4be3aec3119455d5e883381858b9d608cab

        • C:\Users\Admin\AppData\Local\TeamViewer\notify.vbs

          Filesize

          88B

          MD5

          203e5b101aa817c99cc11a8450d12115

          SHA1

          24910eccaf2640f08d1c8948491dbe179bb044b9

          SHA256

          f8f5710726a31e7f50a4ca4a701fac52ccb2da518d5398b22d3853418a380371

          SHA512

          a1edb4501e13ca2495f1a36eb055256d0d786d17bbfa155ee3ab2767ae5953e10b3e6bdf1debfd81fc23e8e8433d95b67bfac1baf3aff8fb19afa63c90cdd7aa

        • C:\Users\Admin\AppData\Local\Temp\11D7DB9F.dll

          Filesize

          2.1MB

          MD5

          f530495445432d6ae00f2b0f08f7c804

          SHA1

          f66f538b95b1a924c8392fbe7743d193d78eb50c

          SHA256

          5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

          SHA512

          2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

        • C:\Users\Admin\AppData\Local\Temp\A9BBC8E0.dll

          Filesize

          2.1MB

          MD5

          f530495445432d6ae00f2b0f08f7c804

          SHA1

          f66f538b95b1a924c8392fbe7743d193d78eb50c

          SHA256

          5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

          SHA512

          2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

          Filesize

          23.0MB

          MD5

          9010740c42216ac30a847db3b9ee3e9d

          SHA1

          6c3ae1a2c1ded9956e70934f1c81101ceae0cf23

          SHA256

          e833c4f7f3a4ee3ba94e5ba3d429cdb75acd71e8abe2091b90b0343530ae723e

          SHA512

          6581768f7dfaab8ef4d3ea3b3381e90251c1add7209da1532e33aa1bec89e676466e1851edb7a4a64340555e57a049f4af57f25a9383d56eea6c68215f8adc65

        • \??\Volume{d2616110-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cc524edf-7189-4a36-a8fd-6dede8d3642e}_OnDiskSnapshotProp

          Filesize

          5KB

          MD5

          1f6881ddb0fa794b4c423c48a110b3df

          SHA1

          e430e471120ba442f26ad5d6380d7c5b9e7c4ab3

          SHA256

          ced2e455117015d15157d0a15c8187c4f985d9826bdc50d26d380ee519cc6440

          SHA512

          29f774f34574bc99440975f66ee450c6a0469e6e4de5321bc4138eb2cf7ee8e65a9864ce21bd2333f768db88d9bf6d2b9ebaca4014276d4bf9f2e1e32b70e64b

        • memory/808-147-0x0000000000C60000-0x0000000000C83000-memory.dmp

          Filesize

          140KB

        • memory/808-150-0x0000000000C60000-0x0000000000C83000-memory.dmp

          Filesize

          140KB

        • memory/3404-139-0x00000000020C0000-0x00000000020E3000-memory.dmp

          Filesize

          140KB