MALICIOUS — 376034e52744b04e294b534b8426d5042310ad1071984733771beb75ce7d19e1

MALICIOUS — 376034e52744b04e294b534b8426d5042310ad1071984733771beb75ce7d19e1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Qakbot family. 6 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 376034e52744b04e294b534b8426d5042310ad1071984733771beb75ce7d19e1
SHA-1: 3252dfb9cad0fe35a8b2739a8088e915cafd2bc2
MD5: d02d829192be778de3e5be232f159f27
imphash: 69b6867f8f2741c550a03eff9f56e771
ssdeep: 24576:E2TFU+CWYPMeX1k2i2TFU+CWYPMeX1k2b2TFU+CWYPMeX1k2i2TFU+CWYPMeX1kh:E2TarkCe2i2TarkCe2b2TarkCe2i2TaM
TLSH: T13955AE65D3169351DAB1EB942E913E0E20B3F4DA917F29C853C3C12E73D9CE3A462246
Submitted as: 376034e52744b04e294b534b8426d5042310ad1071984733771beb75ce7d19e1
File type: pe · Size: 1269778 bytes
Verdict: malicious (98/100) · Family: Qakbot

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Qakbot-9860983-1
Microsoft Defender: Trojan:Win32/Gamaredon!pz
Emsisoft (Emergency Kit): Gen:Variant.Barys.382894
Trellix Stinger (McAfee): W32/PinkSbot-HP!D02D829192BE
Kaspersky (KVRT): Trojan.Win32.Agent.nevpvs

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Qakbot-9860983-1 (rule Win.Malware.Qakbot-9860983-1) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9800 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\SysWOW_x86_64\icxml.sys - 0ae525098835f8b7523d4b36c1470f08919c99ae8eb3b9e33a3d8f032ccddbc9
C:\Users\analyst\AppData\Roaming\Microsoft\SysWOW_x86_64\dwmsys.exe - 984bc3b0f660d24517d29b42e9ed6c8659799f5c675e8448004ce279bf910af9
C:\Users\analyst\AppData\Roaming\Microsoft\SysWOW_x86_64\nthserv.img - 5ca5b39e0b01349bfb3a118c20c483a56b4eda842016e483bdfe1b6c570a816a
C:\Users\analyst\AppData\Roaming\Microsoft\SysWOW_x86_64\nt32.bin - 2091055258ff1f294dd4490ff7c255e9647183a0400ca339642fd6e3d0fd29c0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787846769&P2=404&P3=2&P4=UdKGEu0lOzBPGskpRNglobI%2b%2bd%2fbyf05JjgEh5ynkvsexH6oPA%2bGI7KozFf4ycAgAz9YQwUnK1rR55sYZoKV4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787846813&P2=404&P3=2&P4=gvRgKE4DKGXpbh30ThLC3S5RfiY97AFQOdoyHF4NRVDgP2Z3X6gkeRbuOVSBm24CMDT6ai7jwG4qFw5ltbS3oQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

nwoccs.zapto.org

Embedded IP addresses

4.150.223.106
4.230.171.124
40.84.85.40
52.230.59.222
20.165.94.63
74.179.77.164
20.184.175.1
20.236.44.162
52.123.252.231
52.123.128.14
40.99.134.2
135.233.45.223
52.123.252.213
172.178.240.162
203.26.79.13
92.223.78.30
135.233.95.80
52.110.12.31
52.110.12.25
52.148.114.188
20.42.179.192
72.145.35.108
52.110.12.55

More Qakbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report