Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
15-09-2022 15:56
General
-
Target
well/thoseFor.dll
-
Size
639KB
-
MD5
baa6798c1674853f7dcf003b78ee79ed
-
SHA1
33ac6d3c9c7f82544acf9bc6785dd93346066811
-
SHA256
01cd0c3b1d2de2223fc32d6f96ed98d198c207c19ae6cf4b22ee5af556c40f31
-
SHA512
65757e3c02a1afb9fccb9a50b138bc811cddde2750cb104b9473e5b79bb52fd29ec9f9abd01bc0fe238005a0fcce681e96153e0d2ec80cc526ffc8d2db179db5
-
SSDEEP
12288:GOSe1J015+z6oZZdf/zxY5lbV6hJ84Q7yLCgsy:9j1y5+z6oLdzxmkf8eTs
Malware Config
Extracted
qakbot
403.892
BB
1663241231
81.131.161.131:2078
217.165.85.223:993
37.210.148.30:995
200.161.62.126:32101
78.100.225.34:2222
119.82.111.158:443
66.181.164.43:443
134.35.13.45:443
193.3.19.37:443
99.232.140.205:2222
197.94.210.133:443
87.243.113.104:995
84.38.133.191:443
14.184.97.67:443
123.240.131.1:443
194.166.207.160:995
78.168.87.170:2222
180.180.131.95:443
41.99.21.248:443
190.44.40.48:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\well\thoseFor.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\well\thoseFor.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
656KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
136KB