Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-04-2022 12:56
General
-
Target
88b72fc33495ab3ffbdf23029190e8f795f2f4731530c10306e65d710117a638.dll
-
Size
962KB
-
MD5
3b4ed49d98b2311909673a6b1d9ab959
-
SHA1
6154d39c5794f129df9d94116f46a5da29775acf
-
SHA256
88b72fc33495ab3ffbdf23029190e8f795f2f4731530c10306e65d710117a638
-
SHA512
0b2a08e329a923b25be744a9c66fee7bc53ec06ef21133220f349b18de29e60170c7b3f3d18dc2a8864be50438a993800a8391ec407bee7f58dbf7904adfdce0
Malware Config
Extracted
qakbot
403.573
obama180
1650959141
2.50.4.57:443
85.246.82.244:443
121.7.223.59:2222
197.161.137.67:993
38.70.253.226:2222
47.23.89.62:993
172.114.160.81:443
75.99.168.194:443
82.152.39.39:443
108.60.213.141:443
148.64.96.100:443
167.86.191.84:443
187.207.47.198:61202
103.107.113.120:443
203.122.46.130:443
106.51.48.170:50001
47.23.89.62:995
140.82.49.12:443
102.65.38.74:443
103.246.242.202:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\88b72fc33495ab3ffbdf23029190e8f795f2f4731530c10306e65d710117a638.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\88b72fc33495ab3ffbdf23029190e8f795f2f4731530c10306e65d710117a638.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
572KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
572KB