Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

  • max time kernel
    132s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-10-2021 01:44

General

  • Target

    4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll

  • Size

    488KB

  • MD5

    7f0b9d11c95a65e9e9f87b2341bb01ad

  • SHA1

    93abbf5758c39672d69502690b5e4003a47f9e72

  • SHA256

    4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee

  • SHA512

    eb81b291a55ab91dfaef4a64661b2325c594890ebbcb71b00d5029275c1b7ec43880d85737fceba3c0de1cd20ed94ffa7a9112424c3ef25fd0e21e586a329648

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

obama101

Campaign

1632228858

C2

47.22.148.6:443

24.55.112.61:443

140.82.49.12:443

24.139.72.117:443

136.232.34.70:443

24.229.150.54:995

71.74.12.34:443

73.151.236.31:443

120.150.218.241:995

105.198.236.99:443

76.25.142.196:443

45.46.53.140:2222

144.139.47.206:443

96.37.113.36:993

173.21.10.71:2222

67.165.206.193:993

189.210.115.207:443

109.12.111.14:443

68.204.7.158:443

95.77.223.148:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 732
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1620-115-0x0000000000680000-0x00000000006FE000-memory.dmp

    Filesize

    504KB

  • memory/1620-116-0x0000000000620000-0x0000000000621000-memory.dmp

    Filesize

    4KB

  • memory/1620-117-0x0000000002AF0000-0x0000000002B11000-memory.dmp

    Filesize

    132KB

  • memory/1620-118-0x0000000002AF0000-0x0000000002B11000-memory.dmp

    Filesize

    132KB

  • memory/1620-119-0x0000000002AC0000-0x0000000002AE1000-memory.dmp

    Filesize

    132KB

  • memory/1620-120-0x0000000002AF0000-0x0000000002B11000-memory.dmp

    Filesize

    132KB