Analysis

  • max time kernel
    76s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-02-2022 15:51

General

  • Target

    5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe

  • Size

    2.3MB

  • MD5

    9b8ee3848ba31aeaa8aa3defbd4cbe6f

  • SHA1

    c7ae710907035107eac8a434c7d31e0d89fb370b

  • SHA256

    5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3

  • SHA512

    d57d1c1a2e1981f542059d3dc5efd24f309a7a32adcd8d113b428c9fc1dee10e5f4b15221cea3ef62abd26fa112c6c8d7a94c108402521137fa6affb932190fa

Malware Config

Extracted

Family

qakbot

Version

324.127

Botnet

spx97

Campaign

1586971769

C2

72.214.55.147:995

78.96.64.230:443

100.38.123.22:443

47.205.231.60:443

185.145.113.249:443

72.16.212.107:465

94.52.124.226:443

72.255.200.69:2222

73.56.2.167:443

67.249.222.14:443

71.58.21.235:443

79.113.193.29:443

96.35.170.82:2222

76.111.128.194:443

181.126.86.223:443

67.209.195.198:3389

47.146.169.85:443

47.39.76.74:443

67.131.59.17:443

71.11.209.101:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe
    "C:\Users\Admin\AppData\Local\Temp\5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe
      C:\Users\Admin\AppData\Local\Temp\5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe /C
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1316
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\5259ff740eb9cfdbcb64bfe4c942f48479a578f2ac332da18812a13bf41d03f3.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Windows\SysWOW64\PING.EXE
        ping.exe -n 6 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1392-54-0x00000000754B1000-0x00000000754B3000-memory.dmp
    Filesize

    8KB

  • memory/1392-55-0x0000000000220000-0x0000000000259000-memory.dmp
    Filesize

    228KB

  • memory/1392-56-0x0000000000400000-0x0000000000647000-memory.dmp
    Filesize

    2.3MB