Analysis
-
max time kernel
15s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-03-2021 18:14
General
-
Target
44267.7574392361[3].dat.dll
-
Size
720KB
-
MD5
094ff6f5b463137bbc5633ba8f86c12c
-
SHA1
6f94cd0c6a8705b2549bd1944fbc1f2d9e191035
-
SHA256
0a682e164b078c64ecb724cd359cce68905ef56b8b65dcc4d5e8e54dbbfd585c
-
SHA512
8c633b9232f1dd5e23801cf53e9799eea0266a161d58d38881a96adcdd3c741e3750eae6ec83b94ab893ae4becd7d996aed4b8f951b3e4027f00c98d284d0584
Malware Config
Extracted
qakbot
obama12
1615566531
81.214.126.173:2222
75.118.1.141:443
98.252.118.134:443
81.97.154.100:443
186.31.77.42:443
71.117.132.169:443
24.139.72.117:443
106.51.52.111:443
47.196.192.184:443
24.95.61.62:443
47.22.148.6:443
195.12.154.8:443
71.163.223.159:443
71.41.184.10:3389
193.248.221.184:2222
83.110.108.38:2222
92.59.35.196:2222
73.25.124.140:2222
75.67.192.125:443
83.196.56.65:2222
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7574392361[3].dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7574392361[3].dat.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7643⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
228KB
-
Filesize
4KB