Analysis
-
max time kernel
240s -
max time network
241s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-03-2021 18:02
General
-
Target
44267.7472592593.dat.dll
-
Size
720KB
-
MD5
2a4480ac07ecbe8d0671ec947c1b84c6
-
SHA1
0402ab7b5665b4d2edfc39091ecfe57e8b64bce5
-
SHA256
ff55279d5ef18ff4efb6cd662a7f94f4a5498ccaa2db27df946b6118a32a7c84
-
SHA512
c878a53150e1649a393401dcbf2202ba59fcb0d5441ab8da848d9b4ac3b1cfdaf8f284ce975a56db436cf60d690eb3b1b73c171de270ef3a399e3fe1287595b2
Malware Config
Extracted
qakbot
obama12
1615566531
81.214.126.173:2222
75.118.1.141:443
98.252.118.134:443
81.97.154.100:443
186.31.77.42:443
71.117.132.169:443
24.139.72.117:443
106.51.52.111:443
47.196.192.184:443
24.95.61.62:443
47.22.148.6:443
195.12.154.8:443
71.163.223.159:443
71.41.184.10:3389
193.248.221.184:2222
83.110.108.38:2222
92.59.35.196:2222
73.25.124.140:2222
75.67.192.125:443
83.196.56.65:2222
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7472592593.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7472592593.dat.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 7643⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
236KB
-
Filesize
4KB