Resubmissions

09-01-2023 07:32

230109-jc7g8sgh7x 10

13-09-2022 13:34

220913-qt3zpsbebr 10

Analysis

  • max time kernel
    48s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2022 13:34

General

  • Target

    39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll

  • Size

    389KB

  • MD5

    22c994d8334a898374532a7522f53fcb

  • SHA1

    41f02959057c81b9fc9dc57add4b52698214e335

  • SHA256

    39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6

  • SHA512

    5393a66eaa7e63408f1ac3586985c8eccf4f7d65eac603b562f407e676710ebf15e006c09b2bce1d642f1299862a1373cb9a786adb7218263d5061e2857d691b

  • SSDEEP

    12288:9zlWXAEum0intq9k7PPsVcELe8IrHpDzl/qlhgs:9zQXAEujEQu7Iu8IrHTylhg

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

BB

Campaign

1663053540

C2

194.49.79.231:443

193.3.19.37:443

99.232.140.205:2222

47.146.182.110:443

84.38.133.191:443

191.97.234.238:995

37.210.148.30:995

64.207.215.69:443

200.161.62.126:32101

88.245.103.132:2222

86.98.156.176:993

175.110.231.67:443

78.100.254.17:2222

191.84.204.214:995

123.240.131.1:443

197.94.210.133:443

196.92.172.24:8443

186.50.245.74:995

70.51.132.197:2222

100.1.5.250:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\39428e08fb14d18878d147f91f9cfbd32436a2c07e695e4330e39468b08cd1c6.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 404
          4⤵
          • Program crash
          PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1168-55-0x0000000000000000-mapping.dmp
  • memory/1168-56-0x0000000075571000-0x0000000075573000-memory.dmp
    Filesize

    8KB

  • memory/1168-57-0x00000000001F0000-0x0000000000212000-memory.dmp
    Filesize

    136KB

  • memory/1168-59-0x00000000001F0000-0x0000000000270000-memory.dmp
    Filesize

    512KB

  • memory/1168-60-0x00000000001F0000-0x0000000000270000-memory.dmp
    Filesize

    512KB

  • memory/1168-64-0x00000000001F0000-0x0000000000212000-memory.dmp
    Filesize

    136KB

  • memory/1824-54-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp
    Filesize

    8KB

  • memory/1928-61-0x0000000000000000-mapping.dmp
  • memory/1928-63-0x0000000073F51000-0x0000000073F53000-memory.dmp
    Filesize

    8KB

  • memory/1928-65-0x00000000000C0000-0x00000000000E2000-memory.dmp
    Filesize

    136KB

  • memory/1928-67-0x00000000000C0000-0x00000000000E2000-memory.dmp
    Filesize

    136KB

  • memory/2016-66-0x0000000000000000-mapping.dmp