Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
08-04-2022 17:00
General
-
Target
08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll
-
Size
1.7MB
-
MD5
f6777611b84582a1714ec511ce0f9dcb
-
SHA1
bfc784473dde678b9f52870c292867100f4472e9
-
SHA256
08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac
-
SHA512
e864616a8dca7fd1eae740e60c24003801f9ebbfaa553455ca507b79c0d08d3750ae387665e9a94bda0e77d54c539352c200fec7a3cae739ae9440857a2b2729
Malware Config
Extracted
qakbot
403.573
AA
1649273304
83.110.75.97:2222
47.23.89.62:993
187.207.48.194:61202
45.63.1.12:995
140.82.63.183:995
45.76.167.26:995
140.82.63.183:443
144.202.2.175:995
144.202.3.39:443
149.28.238.199:443
144.202.3.39:995
45.63.1.12:443
149.28.238.199:995
45.76.167.26:443
144.202.2.175:443
100.1.108.246:443
32.221.224.140:995
24.55.67.176:443
31.35.28.29:443
70.51.134.168:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c8093291e391d35310028b3fa0fd130d061e8afec72fff7633026b7fe456ac.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 6483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2636 -ip 26361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2636-124-0x0000000000000000-mapping.dmp
-
memory/2636-125-0x0000000003240000-0x00000000032CB000-memory.dmpFilesize
556KB
-
memory/2636-126-0x0000000003360000-0x00000000033EF000-memory.dmpFilesize
572KB
-
memory/2636-127-0x0000000003360000-0x00000000033EF000-memory.dmpFilesize
572KB
-
memory/2636-128-0x0000000003360000-0x00000000033EF000-memory.dmpFilesize
572KB
-
memory/2936-129-0x0000000000000000-mapping.dmp
-
memory/2936-130-0x0000000000450000-0x00000000004DF000-memory.dmpFilesize
572KB