Analysis
- max time kernel
15s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/03/2021, 18:14
General
- Target 44267.7574392361[3].dat.dll
- Size 720KB
- Sample210312-ma17sg76qx
- SHA256 0a682e164b078c64ecb724cd359cce68905ef56b8b65dcc4d5e8e54dbbfd585c
Score
10/10
Malware Config
Extracted
Family
-
qakbot
Botnet
-
obama12
Campaign
-
1615566531
C2
-
81.214.126.173:2222
-
75.118.1.141:443
-
98.252.118.134:443
-
81.97.154.100:443
-
186.31.77.42:443
-
71.117.132.169:443
-
24.139.72.117:443
-
106.51.52.111:443
-
47.196.192.184:443
-
24.95.61.62:443
-
47.22.148.6:443
-
195.12.154.8:443
-
71.163.223.159:443
-
71.41.184.10:3389
-
193.248.221.184:2222
-
83.110.108.38:2222
-
92.59.35.196:2222
-
73.25.124.140:2222
-
75.67.192.125:443
-
83.196.56.65:2222
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7574392361[3].dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44267.7574392361[3].dat.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 7643⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-3-0x0000000000A71000-0x0000000000AC5000-memory.dmp
memory/656-4-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/656-6-0x00000000044A0000-0x00000000044DB000-memory.dmp
memory/656-5-0x0000000000B60000-0x0000000000B99000-memory.dmp
memory/2584-7-0x0000000005070000-0x0000000005071000-memory.dmp