Analysis
-
max time kernel
449s -
max time network
346s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
15-09-2022 20:37
General
-
Target
012b7a55c5be0892173c386d5394588310b6d24d0c5c89025dfc8fe2f1cbf19e.html
-
Size
712KB
-
MD5
455302a98fcbcb07b22862b05b5bcfd2
-
SHA1
11b8e37d233df53ac4c1eddf55a4d4ca6a4d7969
-
SHA256
012b7a55c5be0892173c386d5394588310b6d24d0c5c89025dfc8fe2f1cbf19e
-
SHA512
0c01555261fd13d3d005e67ed1cd4dad82b6bede58eee3f82a6cb5193db368ebb1df423095dd9d5c00a2851a7f17e9931ace718c24f47f036969c50753ecbfb1
-
SSDEEP
12288:zoo9HXS2fWUU+Ix1uF7bci2HizBI+wIe4iqSkD4NaxE5h0:8QiLF+5UCzBI+wIcLkDSaS5h0
Malware Config
Extracted
qakbot
403.892
obama203
1663242106
81.131.161.131:2078
217.165.85.223:993
37.210.148.30:995
200.161.62.126:32101
78.100.225.34:2222
119.82.111.158:443
66.181.164.43:443
134.35.13.45:443
193.3.19.37:443
99.232.140.205:2222
197.94.210.133:443
87.243.113.104:995
84.38.133.191:443
14.184.97.67:443
123.240.131.1:443
194.166.207.160:995
78.168.87.170:2222
180.180.131.95:443
41.96.56.224:443
190.44.40.48:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 41 IoCs
-
Modifies registry class 48 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\012b7a55c5be0892173c386d5394588310b6d24d0c5c89025dfc8fe2f1cbf19e.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4556 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Document#138027(Sep15)~\" -spe -an -ai#7zMap7654:94:7zEvent81021⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "E:\all\byDo.js"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\all\beUse.bat" re gs v"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeregsvr32 all/wantLike.db3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeall/wantLike.db4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD564516f819c8da76f402e4b40799ddadf
SHA1d8582566e6b62bf032adac5699c1649e3a009f94
SHA256471042636f1151ffc6880459c33a579f669808e93f2043a073d1c8af241e28d4
SHA512431396796a20d97b545e4cf07646b8ce5c9e47c198bd9f24b9d1546064b7acd60f3828eab3c52ff43db3d5b4814466176421d42d183795b0e04d6d10bdd07c97
-
Filesize
404B
MD5256ce667906475d1856d41e904fc63f0
SHA1bf34589d833e0fcd9b055cd7c7a53c0221ae3003
SHA2565369f32c60db61bca97323b3fa8b0b603672f76a35eb39b29a6fab690f40b8e1
SHA512cf814148f9c0f2c93607bdc7b009fca1b8fab5ed4f60698af90b1f6e055de005bd34bc653cacbe18747295db9863b6724b0732b4ecd1057771b50b101d83f2bf
-
Filesize
367KB
MD51bbe0d41d7706d58496c604ca16a3d96
SHA125be75d2ef660470f21df1c740c1c1aa1948229f
SHA25681bd951d2f93394159aacc586a23c0e90e3322adc2ec047ccf5bcfcc1bb4aaeb
SHA512fa8ec881cffa66afdd8e841157fcc051486807232cf5d9da453d40df9a7b9e6a7dda61abb5308f7d587ee99d56fd219cb957d517a07b410a8a27a40832b80cf9
-
Filesize
367KB
MD51bbe0d41d7706d58496c604ca16a3d96
SHA125be75d2ef660470f21df1c740c1c1aa1948229f
SHA25681bd951d2f93394159aacc586a23c0e90e3322adc2ec047ccf5bcfcc1bb4aaeb
SHA512fa8ec881cffa66afdd8e841157fcc051486807232cf5d9da453d40df9a7b9e6a7dda61abb5308f7d587ee99d56fd219cb957d517a07b410a8a27a40832b80cf9
-
-
Filesize
136KB
-
Filesize
152KB
-
Filesize
136KB
-
Filesize
136KB
-
-
-
Filesize
136KB
-