Overview

overview

10

Static

static

1

93a98b919a...7f.msi

windows10-1703-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    80s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29-02-2024 03:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi

  • Size

    1.9MB

  • MD5

    82b8bd90e500fb0bf878d6f430c5abec

  • SHA1

    f004c09428f2f18a145212a9e55eef3615858f9c

  • SHA256

    93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f

  • SHA512

    82b2e997bf5bc0d08ab8dd921aef3e8d620a61c26f86b6f481845ad694d7b97f65dfa42e1c18b83f0f827cad9df69a409b75d96793e5bd7124c26bc7cb07f881

  • SSDEEP

    49152:Ksjitd+vszAlozTy4g5r8+5eNBABxGNvXreD68f:rihTyfcXreO8f

Score
10/10
qakbotbankerstealertrojan

Malware Config

Signatures

  • Detect Qakbot Payload 12 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3832
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F0211DC2D365816FBC5A452C4ADF9D13 C
      2⤵
      • Loads dropped DLL
      PID:4680
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3476
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6EBFAFF1833F3B6DF203D8496EA5482D
        2⤵
        • Loads dropped DLL
        PID:4240
      • C:\Windows\Installer\MSIB472.tmp
        "C:\Windows\Installer\MSIB472.tmp" /HideWindow rundll32 C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3944
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:3388
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
        1⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:1084
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\System32\wermgr.exe
          C:\Windows\System32\wermgr.exe
          2⤵
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:4748

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e57978e.rbs
        Filesize

        1KB

        MD5

        de52a5d0b4736a97d4c22dfa26e36383

        SHA1

        409bc051a08f29f7904681790965ca7ea57b1364

        SHA256

        7fe5cbd94d26b6385cd88c6c7833d9b935e07063b7b7e80aabbb0b883157adca

        SHA512

        908daf45be172b0eb76b4154404bc758c37a459fcd251f93f455318c6a2ac83afb0722ee1f7d7c74450fe2d4193052c1af20dc6427944deca6482e45f2e22a56

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C42BC945025A34066DAB76EF3F80A05
        Filesize

        50KB

        MD5

        5d3ab674eea69ccf3c600a414e89607c

        SHA1

        1ec0289cfa412d5551d293264a6a3993c1e3e432

        SHA256

        46d875c64bd6095bc623463f01dab030b5b1e215f0242620d441fb4f9500119f

        SHA512

        4c16f4ef21f393fcadd21a67c23810025a1caeb7b00b965fbabb5797d87149d13cfcdfe2d57d7ef8eec7e66f727961e66f214418c82924298b71ba04a345573c

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
        Filesize

        727B

        MD5

        7a3b8457313a521e0d44f91765a4e041

        SHA1

        4ea8ecb5e7b4c11f4c491caf6cee7ced5ec4c267

        SHA256

        2b08ecf53bb8b6c430659926148f896102dc80b5f38b0ec5efe122199659651c

        SHA512

        7349fd1b8c490d540a8bb25f40587f9874ff5d9b1f9bdb2ea69db9218ebdbdccea5e4d6645fbd1098d051b008b1ebfd12a619c3a4d6fb54940705ab14933e159

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C42BC945025A34066DAB76EF3F80A05
        Filesize

        314B

        MD5

        553d6b1c25006148a41228871cde85aa

        SHA1

        eb224c3b15e92efc30d5b19c99266d9d77c472fe

        SHA256

        2c3228a4fbcd2e6b82c4bff3d13a928c8a75841ceeb8a6090ea4109e3ae58ffc

        SHA512

        fe6e24dd340abe432dc3bab7cd13755a954678b06d3cc96476a601be76c4fde2d4ff89fa2c7c739eb365d0cef1d0082136abfd34581556b9dfbb49e80f909fb9

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
        Filesize

        478B

        MD5

        f22428c1950b3c66bf01ea0386260348

        SHA1

        480c9f7ec6879ff4971fe25cbd310f540fcf99e1

        SHA256

        867d7e6b17f1b86528e09ca8a5a014f66d500b8c6d6d734b98c08483d3b399b4

        SHA512

        f4f96de4c5fd11d27f9d3790144ea72177b599f5e0b21f6408ba09b83305a67616c7a369f54d12515e1aa90f5fe1d6a8d1eef46802be00a175720ba7825a60b7

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\MSI6DEC.tmp
        Filesize

        721KB

        MD5

        5a1f2196056c0a06b79a77ae981c7761

        SHA1

        a880ae54395658f129e24732800e207ecd0b5603

        SHA256

        52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

        SHA512

        9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

        Download Submit
      • C:\Windows\Installer\MSIB472.tmp
        Filesize

        397KB

        MD5

        b41e1b0ae2ec215c568c395b0dbb738a

        SHA1

        90d8e50176a1f4436604468279f29a128723c64b

        SHA256

        a97e782c5612c1a9c8a56c56a943f6190fa7a73c346566860b519ef02efd0dca

        SHA512

        828d00ea08aa5c5d28b2e513687ee1ff910670f49f938064682e56da05544ba9d73ba9244f77b5df8acaeeb7b756d62f67e5acbc95bae86b4706f6324c4ccaba

        Download Submit
      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        Filesize

        25.0MB

        MD5

        6e96ec58bc35da11c87c83f81f304a2d

        SHA1

        5c2f544f2f6a22b2a2a068477c96f6a258ac4745

        SHA256

        9127c674f4e85a833285482745c227f126c353f96c446040e096824aa31b07ff

        SHA512

        e60250c2c55ebed39da40c14498e8095b68f2ac7d3c4cea61e46aa29bcaf4dcb92c7140dc9fd6454f3b907d582ee945973ddd0bebc016fb7fb0e8f166abdc7ba

        Download Submit
      • \??\Volume{ac3b6578-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{52834766-ee5b-4eea-b6b9-2f29057dff95}_OnDiskSnapshotProp
        Filesize

        5KB

        MD5

        439b70918e1c8608151353c14e2080ec

        SHA1

        cca32c12cc323f232cd8de99f50b8ed3e77fc259

        SHA256

        e484a31d5710d8424042cbbfcbac0cb115ec0b47c8027f4e00405947aece33e9

        SHA512

        ae198bc03e9ff4b4b914b69d288eba3fa5bf96e9faae79ff40d115c8523d0829d365f86af19c55bef4b610adc166125dac00ed6b84fc29e0e21f79ee53b8cc2f

        Download Submit
      • \Users\Admin\AppData\Roaming\KROST.dll
        Filesize

        459KB

        MD5

        0a29918110937641bbe4a2d5ee5e4272

        SHA1

        7d4a6976c1ece81e01d1f16ac5506266d5210734

        SHA256

        780be7a70ce3567ef268f6c768fc5a3d2510310c603bf481ebffd65e4fe95ff3

        SHA512

        998a6ee2fa6b345aeea72afaa91add8433e986a2678dbb8995ead786c30bdc00704c39c4857935b20669005b292736d50e1c6ad38901aa1f29db7b6a597fae3f

        Download Submit
      • memory/4364-98-0x000001BED0130000-0x000001BED015D000-memory.dmp
        Filesize

        180KB

        Download
      • memory/4364-94-0x000001BED02A0000-0x000001BED02CF000-memory.dmp
        Filesize

        188KB

        Download
      • memory/4364-93-0x0000000069140000-0x00000000691BE000-memory.dmp
        Filesize

        504KB

        Download
      • memory/4364-99-0x0000000180000000-0x000000018002E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4364-100-0x0000000180000000-0x000000018002E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4364-118-0x0000000180000000-0x000000018002E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-108-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-102-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-101-0x00000168444F0000-0x00000168444F2000-memory.dmp
        Filesize

        8KB

        Download
      • memory/4748-126-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-127-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-128-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-129-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download
      • memory/4748-130-0x00000168444C0000-0x00000168444EE000-memory.dmp
        Filesize

        184KB

        Download