Analysis

  • max time kernel
    156s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2023 16:12

General

  • Target

    ProjectFunding_450726_Jun01.js

  • Size

    1KB

  • MD5

    a657553449746c482dacfe3b19119b7a

  • SHA1

    630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53

  • SHA256

    44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948

  • SHA512

    dea33536a5c5fe279ca1a8a3d4639be0f49d5ca3c21f4cbbda10c5d059837c2bc4c3917cdbddd0fc9f4a0773f325369b200f0df8e0035da6afab26f09502c321

Malware Config

Extracted

Family

qakbot

Version

404.1346

Botnet

obama266

Campaign

1685611378

C2

24.234.220.88:990

70.28.50.223:2078

96.56.197.26:2083

103.123.223.133:443

83.249.198.100:2222

199.27.66.213:443

90.104.151.37:2222

94.204.202.106:443

72.205.104.134:443

65.95.141.84:2222

82.131.141.209:443

77.126.99.230:443

71.38.155.217:443

205.237.67.69:995

84.215.202.8:443

24.234.220.88:465

76.178.148.107:2222

116.74.163.130:443

70.28.50.223:2087

147.147.30.126:2222

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_450726_Jun01.js
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3260
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1000
      • C:\Windows\system32\wscript.exe
        wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
        2⤵
          PID:824
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1948
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2016
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:2668

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e572e25.rbs

        Filesize

        9KB

        MD5

        20c8748771234907f298ab6c19d0ef88

        SHA1

        cddfcd5fee5cfee3b4324fb5a95f99744bb04f22

        SHA256

        ef91a95e39707614436547ad2b8d9432adf3350ca801291e2abb42d5b3bc5da8

        SHA512

        5e383d2eb0238d0b40552949e0ef2d3ec2dd6486905aa820f5d71d3faa6f378db155fe10f78ca0e680539c83e389ec9d13624223e30fe295868e08a25860a874

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

        Filesize

        752KB

        MD5

        e363ab66e88773ccf7e3099c104f2e9e

        SHA1

        d4f3c0fda1bfb983f49facbfdb73054b7cbe57f9

        SHA256

        f4ebbb6df51313699d35d72a58030878d04bcc6f32ae4ef8c24e59c45e3b1b9f

        SHA512

        be86609cd2f065716a342643c39a82d8a6f165233a60bb425202290269dc1dc110b844665b67c148489708e3c1f5a1add671ccdf6a0a9335928b5d9fd59b4d26

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

        Filesize

        752KB

        MD5

        e363ab66e88773ccf7e3099c104f2e9e

        SHA1

        d4f3c0fda1bfb983f49facbfdb73054b7cbe57f9

        SHA256

        f4ebbb6df51313699d35d72a58030878d04bcc6f32ae4ef8c24e59c45e3b1b9f

        SHA512

        be86609cd2f065716a342643c39a82d8a6f165233a60bb425202290269dc1dc110b844665b67c148489708e3c1f5a1add671ccdf6a0a9335928b5d9fd59b4d26

      • C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

        Filesize

        132B

        MD5

        0d4c9f15ce74465c59ae36a27f98c817

        SHA1

        9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a

        SHA256

        d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a

        SHA512

        9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f

      • C:\Windows\Installer\MSIB79D.tmp

        Filesize

        404KB

        MD5

        3f97af6fab9f837be11f50b7b49fa2ef

        SHA1

        15bbf6f3198cfe1dca7eb35c239c13488ea65b01

        SHA256

        1430c435b3e786d45da166b8797960545d75bedda0880da91c866d8fd2bee0cf

        SHA512

        e88970c73577dcda5fb20bb5f3935be4b5ad9c3173542153aecab7beed2b377788df304126d9d5c22cc22188081dd00659a4cd40d2a2a400ccd134ad27bf5f05

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

        Filesize

        23.0MB

        MD5

        ab87c1f9e83ac135e8f8d1032b442795

        SHA1

        fb6dfa7040deb72db3dcb93668f6c10def9ab02b

        SHA256

        aee1ad2325094a899de2fd6a03a45e7fa8fe61654707005ae72858bd90b2f4c8

        SHA512

        3dba6e07aac120ae0a37a497884969dd8f8e129323b6e031bb8c0edd4a1cc1d3589601cfd784de55ee39af582eebb7122cb0132f6981699b60e7457a5c9d850e

      • \??\Volume{c9ab6598-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{55e9168d-5946-48bf-849f-fb1b27d01aca}_OnDiskSnapshotProp

        Filesize

        5KB

        MD5

        03785117e0a995597a8db6b88fdf3369

        SHA1

        3237a6a9df834bbd88e817fb8991f429fd598d70

        SHA256

        aab745a8cd01c3a621177cb3f78e990b91340a3a51441ad6152301acf5294fc8

        SHA512

        08de574520f6749486a5f9d0ef8dfff336951fe8125f798255d732514920dded74b0d080a8046f9285087961a578bb937c01a587406e30c02ba5f4a4cfa3b4a6

      • memory/2016-172-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/2016-171-0x0000000000A60000-0x0000000000A62000-memory.dmp

        Filesize

        8KB

      • memory/2016-178-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/2016-179-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/2016-180-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/2016-181-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/2016-182-0x0000000000A30000-0x0000000000A54000-memory.dmp

        Filesize

        144KB

      • memory/3208-166-0x00000000010E0000-0x0000000001104000-memory.dmp

        Filesize

        144KB

      • memory/3208-165-0x00000000010B0000-0x00000000010B3000-memory.dmp

        Filesize

        12KB