# Malware Analysis Report Template

This template provides the standard structure for malware analysis reports.
Each section includes guidance notes and example content.

---

## Report Header

```
Title:          Malware Analysis Report: [Family/Sample Name]
Report ID:      MAR-YYYY-NNNN
Date:           YYYY-MM-DD
Classification: TLP:AMBER
Analyst:        [Name]
```

---

## 1. Executive Summary

Provide a high-level overview (3-5 sentences) covering:
- What was analyzed (sample name, type)
- Key findings (malware family, capabilities)
- Business impact assessment
- Recommended immediate actions

**Example:**

> This report documents the analysis of `invoice_2025.exe` (SHA256: `a1b2c3...`),
> identified as a variant of the **Qakbot** banking trojan. The sample establishes
> persistence via scheduled tasks, injects into legitimate processes, and
> communicates with 12 C2 servers over HTTPS. The threat severity is assessed as
> **HIGH** due to credential theft and lateral movement capabilities. Immediate
> actions include blocking identified C2 domains at the proxy/firewall and
> scanning all endpoints for the listed IOCs.

---

## 2. Sample Information

| Property | Value |
|----------|-------|
| File Name | `invoice_2025.exe` |
| File Size | 342,016 bytes (334 KB) |
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | `d41d8cd98f00b204e9800998ecf8427e` |
| SHA1 | `da39a3ee5e6b4b0d3255bfef95601890afd80709` |
| SHA256 | `a1b2c3d4e5f6...` |
| ssdeep | `6144:Kl0Qa+gJhS3xR:a+gS3xR` |
| Compilation Timestamp | 2025-01-10 08:23:41 UTC |
| Packer/Compiler | Microsoft Visual C++ 2019 |
| First Seen | 2025-01-12 (VirusTotal) |
| VT Detection | 48/72 |

---

## 3. Technical Findings

### Finding 1: [CRITICAL] Process Injection via Process Hollowing

**Description:** The malware creates a suspended instance of `explorer.exe` and
replaces its memory with malicious code using the process hollowing technique.

**Evidence:**
- API calls: `CreateProcessW` (CREATE_SUSPENDED), `NtUnmapViewOfSection`,
  `VirtualAllocEx`, `WriteProcessMemory`, `ResumeThread`
- Target process: `C:\Windows\explorer.exe`
- Observed in sandbox execution at T+3.2 seconds

**ATT&CK:** T1055.012 - Process Injection: Process Hollowing

---

### Finding 2: [HIGH] C2 Communication over HTTPS

**Description:** The malware contacts 12 hardcoded C2 servers using HTTPS POST
requests with a custom binary protocol encrypted with RC4.

**Evidence:**
- C2 domains extracted from decrypted configuration blob
- Network traffic observed to `api.evil-domain[.]com:443`
- Custom User-Agent: `Mozilla/5.0 (compatible; update-agent/2.1)`
- RC4 key: `0x41 0x42 0x43 0x44...` (extracted from .data section)

**ATT&CK:** T1071.001 - Application Layer Protocol: Web Protocols

---

### Finding 3: [HIGH] Credential Harvesting

**Description:** The malware hooks browser APIs to intercept form submissions
and extracts stored credentials from browser SQLite databases.

**Evidence:**
- Hooks: `HttpSendRequestW`, `InternetWriteFile`
- Accessed files: `Login Data` (Chrome), `logins.json` (Firefox)
- Credential exfiltration observed via C2 channel

**ATT&CK:** T1555.003 - Credentials from Password Stores: Credentials from Web Browsers

---

### Finding 4: [MEDIUM] Persistence via Scheduled Task

**Description:** Creates a scheduled task named "SystemUpdateCheck" that executes
the malware at user logon with SYSTEM privileges.

**Evidence:**
```
schtasks /create /tn "SystemUpdateCheck" /tr "C:\Users\Public\svchost.exe"
  /sc ONLOGON /ru SYSTEM /f
```

**ATT&CK:** T1053.005 - Scheduled Task/Job: Scheduled Task

---

## 4. Indicators of Compromise (IOCs)

### File Indicators

| Type | Value | Context |
|------|-------|---------|
| SHA256 | `a1b2c3d4e5f6...` | Main payload |
| SHA256 | `f6e5d4c3b2a1...` | Dropped DLL |
| MD5 | `d41d8cd98f00b204...` | Main payload |

### Network Indicators

| Type | Value | Context |
|------|-------|---------|
| Domain | `api.evil-domain[.]com` | C2 server |
| Domain | `update.malware-cdn[.]net` | Payload delivery |
| IP | `185.100.87[.]42` | C2 infrastructure |
| IP | `91.215.85[.]17` | C2 infrastructure |
| URL | `https://api.evil-domain[.]com/gate.php` | C2 callback URL |

### Host Indicators

| Type | Value | Context |
|------|-------|---------|
| Mutex | `Global\{A1B2C3D4-E5F6-...}` | Execution check |
| File Path | `C:\Users\Public\svchost.exe` | Dropped payload |
| Registry | `HKCU\Software\Microsoft\CurrentVersion\Run\SysUpdate` | Persistence |
| Scheduled Task | `SystemUpdateCheck` | Persistence |
| Service | `WindowsUpdateSvc` | Persistence |

---

## 5. MITRE ATT&CK Mapping

| Technique ID | Name | Tactic | Evidence |
|-------------|------|--------|----------|
| T1566.001 | Phishing: Spearphishing Attachment | Initial Access | Delivered via email |
| T1059.001 | PowerShell | Execution | Encoded PS command in macro |
| T1055.012 | Process Hollowing | Defense Evasion | Injection into explorer.exe |
| T1053.005 | Scheduled Task | Persistence | "SystemUpdateCheck" task |
| T1555.003 | Credentials from Web Browsers | Credential Access | Chrome/Firefox credential theft |
| T1071.001 | Web Protocols | Command and Control | HTTPS C2 communication |
| T1041 | Exfiltration Over C2 Channel | Exfiltration | Data sent via C2 HTTPS |

---

## 6. Detection Rules

### YARA Rule

```yara
rule Qakbot_Variant_2025 {
    meta:
        description = "Detects Qakbot variant from January 2025 campaign"
        author = "Analyst"
        date = "2025-01-15"
        reference = "MAR-2025-0042"

    strings:
        $mutex = "Global\\{A1B2C3D4-E5F6-" ascii wide
        $ua = "update-agent/2.1" ascii
        $rc4_init = { 8B 45 ?? 33 C9 89 4D ?? 8D 85 }
        $config_marker = { 50 4B 03 04 14 00 08 00 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 1MB and
        2 of them
}
```

### Suricata Rule

```
alert tls $HOME_NET any -> $EXTERNAL_NET any (
    msg:"MALWARE Qakbot C2 SSL Certificate";
    tls.subject:"CN=api.evil-domain.com";
    reference:md5,d41d8cd98f00b204e9800998ecf8427e;
    classtype:trojan-activity;
    sid:2025001; rev:1;
)
```

### Sigma Rule

```yaml
title: Qakbot Scheduled Task Persistence
status: experimental
description: Detects Qakbot persistence via scheduled task creation
logsource:
    product: windows
    service: sysmon
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:
            - 'schtasks'
            - '/create'
            - 'SystemUpdateCheck'
            - 'svchost.exe'
    condition: selection
level: high
tags:
    - attack.persistence
    - attack.t1053.005
```

---

## 7. Remediation Recommendations

### Immediate Containment (Priority: CRITICAL)

1. Block all listed C2 domains and IPs at firewall and proxy
2. Isolate confirmed infected endpoints from the network
3. Reset credentials for users on affected systems
4. Disable the "SystemUpdateCheck" scheduled task on affected hosts

### Eradication (Priority: HIGH)

1. Remove `C:\Users\Public\svchost.exe` and associated dropped files
2. Delete registry persistence keys listed in IOCs
3. Remove scheduled task "SystemUpdateCheck"
4. Terminate malicious processes and clear injected code
5. Run full AV/EDR scan with updated signatures

### Recovery (Priority: MEDIUM)

1. Restore affected files from known-good backups
2. Rebuild compromised systems if integrity cannot be verified
3. Re-image systems where rootkit or bootkit activity is suspected
4. Validate system integrity with baseline comparisons

### Prevention (Priority: MEDIUM)

1. Deploy updated YARA and Sigma rules to detection infrastructure
2. Add IOCs to threat intelligence platform and SIEM watchlists
3. Review email filtering rules to catch similar phishing campaigns
4. Conduct user awareness training on phishing identification
5. Implement application whitelisting to prevent unauthorized execution

---

## 8. Appendices

### Appendix A: Full String Dump (Selected)

```
CreateProcessW
NtUnmapViewOfSection
VirtualAllocEx
WriteProcessMemory
api.evil-domain.com
update.malware-cdn.net
Mozilla/5.0 (compatible; update-agent/2.1)
SystemUpdateCheck
```

### Appendix B: Network Traffic Summary

```
192.168.1.100 -> 185.100.87.42:443 (TLS) - 247 packets, 128KB
192.168.1.100 -> 91.215.85.17:443 (TLS) - 53 packets, 24KB
```

### Appendix C: Timeline of Events

| Time (UTC) | Event |
|------------|-------|
| 2025-01-12 09:15:00 | Phishing email received |
| 2025-01-12 09:18:23 | User opened attachment |
| 2025-01-12 09:18:25 | Macro executed PowerShell |
| 2025-01-12 09:18:30 | Payload downloaded and executed |
| 2025-01-12 09:18:33 | Process hollowing (explorer.exe) |
| 2025-01-12 09:18:35 | Scheduled task created |
| 2025-01-12 09:18:40 | C2 communication initiated |
| 2025-01-12 09:25:00 | Credential harvesting started |

---

*TLP:AMBER | MAR-2025-0042 | Generated 2025-01-15*