Analysis
-
max time kernel
149s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-06-2022 07:22
General
-
Target
1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963.dll
-
Size
700KB
-
MD5
3bfc926058e162af3b5302b22a83fd9c
-
SHA1
83aa84133fac2d8069dceb21c803d93394512dde
-
SHA256
1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963
-
SHA512
db94313d4fa4272ff9611326ec9407d78782c04dbbf5051b288f1b290901f9a950c7d62b133254a07d52318e71a6dae17911cb904db2b6b13e8441d1ec58760d
Malware Config
Extracted
qakbot
403.780
AA
1656051427
217.128.122.65:2222
24.43.99.75:443
67.209.195.198:443
208.107.221.224:443
70.46.220.114:443
32.221.224.140:995
88.241.122.55:443
186.90.153.162:2222
148.64.96.100:443
197.87.182.93:443
39.44.30.209:995
67.165.206.193:993
118.161.2.13:995
111.125.245.116:995
104.34.212.7:32103
86.200.151.188:2222
41.228.22.180:443
94.59.15.180:2222
24.178.196.158:2222
182.191.92.203:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b64ce64b4aa35ebe9259cf56cd159f0cd3220dc0cceb8c0ed5eec14a25a1963.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 09:25 /tn vdbqcnak /ET 09:36 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQBiADYANABjAGUANgA0AGIANABhAGEAMwA1AGUAYgBlADkAMgA1ADkAYwBmADUANgBjAGQAMQA1ADkAZgAwAGMAZAAzADIAMgAwAGQAYwAwAGMAYwBlAGIAOABjADAAZQBkADUAZQBlAGMAMQA0AGEAMgA1AGEAMQA5ADYAMwAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-62-0x0000000000000000-mapping.dmp
-
memory/1532-68-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1532-66-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1532-64-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/1736-67-0x0000000000000000-mapping.dmp
-
memory/2016-57-0x0000000000930000-0x0000000000952000-memory.dmpFilesize
136KB
-
memory/2016-60-0x00000000007B0000-0x00000000007E6000-memory.dmpFilesize
216KB
-
memory/2016-61-0x0000000000930000-0x0000000000952000-memory.dmpFilesize
136KB
-
memory/2016-58-0x0000000000930000-0x0000000000952000-memory.dmpFilesize
136KB
-
memory/2016-59-0x0000000000930000-0x0000000000952000-memory.dmpFilesize
136KB
-
memory/2016-65-0x0000000000930000-0x0000000000952000-memory.dmpFilesize
136KB
-
memory/2016-54-0x0000000000000000-mapping.dmp
-
memory/2016-56-0x00000000006C0000-0x0000000000770000-memory.dmpFilesize
704KB
-
memory/2016-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB