Analysis
- max time kernel
39s - max time network
110s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/05/2021, 10:08
General
- Target a2869406c4661b2c003f0d38aebe8f8e5715bdbc7d67e429023cb0726dbc13f5.dll
- Size 1.0MB
- Sample210507-drc7gl5kde
- SHA256 a2869406c4661b2c003f0d38aebe8f8e5715bdbc7d67e429023cb0726dbc13f5
Score
10/10
Malware Config
Extracted
Family
-
qakbot
Version
-
401.138
Botnet
-
domain02
Campaign
-
1613028094
C2
-
32.210.98.6:443
-
70.49.88.199:2222
-
151.205.102.42:443
-
178.152.79.153:995
-
216.195.46.163:2222
-
72.252.201.69:443
-
90.65.236.181:2222
-
98.173.34.212:995
-
97.69.160.4:2222
-
69.245.102.225:443
-
144.139.166.18:443
-
73.25.124.140:2222
-
189.223.205.126:443
-
157.131.108.180:443
-
71.197.126.250:443
-
73.228.197.5:443
-
151.213.189.62:443
-
24.229.150.54:995
-
84.72.35.226:443
-
199.19.117.131:443
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2869406c4661b2c003f0d38aebe8f8e5715bdbc7d67e429023cb0726dbc13f5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2869406c4661b2c003f0d38aebe8f8e5715bdbc7d67e429023cb0726dbc13f5.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 7643⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3464-115-0x0000000000E20000-0x0000000000F27000-memory.dmp
memory/3464-116-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/3464-117-0x00000000049E0000-0x0000000004A40000-memory.dmp
memory/3464-118-0x0000000004A40000-0x0000000004A75000-memory.dmp