Analysis

  • max time kernel
    538s
  • max time network
    504s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2023 22:24

General

  • Target

    ProjectFunding_268488_Jun01.js

  • Size

    1KB

  • MD5

    4d4c10bc91a9f0f55ae4e3f13028e21c

  • SHA1

    ca582c0d141a690f6bb59c25fb7cc521f80d09d7

  • SHA256

    c103447a81a20f57e6b80dd939b58e442398d97e5c96acba87482af4ae433848

  • SHA512

    8dbbfc5e903ee05459899d14d95547dfaef78e42262f8c36bd94b27ab7a35cc7bbd2298ed9faded8eb6f2fda2d1d821192a13e4f030973d0270c76f9ca7137fe

Malware Config

Extracted

Family

qakbot

Version

404.1346

Botnet

obama266

Campaign

1685611378

C2

24.234.220.88:990

70.28.50.223:2078

96.56.197.26:2083

103.123.223.133:443

83.249.198.100:2222

199.27.66.213:443

90.104.151.37:2222

94.204.202.106:443

72.205.104.134:443

65.95.141.84:2222

82.131.141.209:443

77.126.99.230:443

71.38.155.217:443

205.237.67.69:995

84.215.202.8:443

24.234.220.88:465

76.178.148.107:2222

116.74.163.130:443

70.28.50.223:2087

147.147.30.126:2222

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_268488_Jun01.js
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:180
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4796
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1900
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:964
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              5⤵
              • Gathers network information
              PID:1984
            • C:\Windows\SysWOW64\whoami.exe
              whoami /all
              5⤵
                PID:216
        • C:\Windows\system32\wscript.exe
          wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
          2⤵
            PID:3792
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:4372
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
            PID:184

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e57aa1c.rbs

            Filesize

            9KB

            MD5

            ee686de077e03cb56f48a0a112bd75ef

            SHA1

            93d8bd85f2b211acc95da8b658361ba83b40cbc5

            SHA256

            6995b3d0452b72751077236ed71989b53b77e3a258ad226609e5e207db63f983

            SHA512

            6799cb1b1c4409aab4b27a4c223d9008e05f7ecfa287921317121cd81f3f664fc69fe479ad69659c44b0b634678a0b4d725d12ffe43f4b2b9aefa6c4e36af8bd

          • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

            Filesize

            752KB

            MD5

            a9b2ae0ff67dbe87ced4b08dee184b15

            SHA1

            ac3101c2db7912b8c90fb323dabd34228081aa6b

            SHA256

            b7f36f9b2a633ef3019f0dbd9a3e1689a328fce2c9718505bb45442c1829d2c0

            SHA512

            a4bc2bdb28ee428004c4d694908ad84761a61e2cb2cc182ecc9670280c668c9922915808daef725021d2865fdb8864501c15096a1af58a4ec17207ad4488614d

          • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

            Filesize

            752KB

            MD5

            a9b2ae0ff67dbe87ced4b08dee184b15

            SHA1

            ac3101c2db7912b8c90fb323dabd34228081aa6b

            SHA256

            b7f36f9b2a633ef3019f0dbd9a3e1689a328fce2c9718505bb45442c1829d2c0

            SHA512

            a4bc2bdb28ee428004c4d694908ad84761a61e2cb2cc182ecc9670280c668c9922915808daef725021d2865fdb8864501c15096a1af58a4ec17207ad4488614d

          • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

            Filesize

            132B

            MD5

            0d4c9f15ce74465c59ae36a27f98c817

            SHA1

            9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a

            SHA256

            d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a

            SHA512

            9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f

          • C:\Windows\Installer\MSI2DD6.tmp

            Filesize

            404KB

            MD5

            e54f16d1a308f1f31865de24f5336d8c

            SHA1

            f345b6262e40e10bbcd06fb2db53b346b82f6a88

            SHA256

            728170cdd8115f6a897d01235d62259466b6f3540e92e7166a07d7c44661f1d5

            SHA512

            138d2d7b12bd95b1a3647da6c357fbf79b99736734d80611247d881ebed6e41b9dcf765eb4ab1db2d07f990c50a69a97df2029a9b3375f93970ebe1856208ffe

          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

            Filesize

            23.0MB

            MD5

            e984953caf82d7f87aa8071d85fe033a

            SHA1

            dd016fb760f516053fc3b21faff9dee2adb47aea

            SHA256

            1c12e4e5678a213176eb0e694a465dc17c822907c1ae36bb8552c1bb92d80361

            SHA512

            b5f70a0c215a6286e43bab73db87eef9f32cfd032295754d2edb8c5151f43d6e5238dab68f3fd3d441f4165428258222d3e14c23bd2f6b503723ef22c402cf54

          • \??\Volume{af0fc727-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f20c350b-7bc4-4118-b78b-55c3ddffe2c3}_OnDiskSnapshotProp

            Filesize

            5KB

            MD5

            153f9842f28382d036c856d4b58ef0c3

            SHA1

            6126357732aacf5ab1f1adb64c4887900b5b4d80

            SHA256

            563996c43ed81ef350460df16e50dc0ec336f7877dd2da7d0d009aa02accd3ae

            SHA512

            6233c56a03a58a143b960f904f08a103212424e19d1d1694d51dca3dd8c1ad65df9304d90ad2f534b4c2acb2f505e9dca1d5570c76292e1a5483643008973217

          • memory/964-193-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-190-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-178-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-179-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-180-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-181-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-182-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-171-0x00000000006D0000-0x00000000006D2000-memory.dmp

            Filesize

            8KB

          • memory/964-209-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-172-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-191-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-208-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-199-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-206-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/964-207-0x00000000006A0000-0x00000000006C4000-memory.dmp

            Filesize

            144KB

          • memory/1836-165-0x0000000002F10000-0x0000000002F13000-memory.dmp

            Filesize

            12KB

          • memory/1836-166-0x0000000003030000-0x0000000003054000-memory.dmp

            Filesize

            144KB