Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
16-09-2022 17:13
General
-
Target
more/veryAs.dll
-
Size
484KB
-
MD5
124405e8f46a33ff523128b208c951d7
-
SHA1
6a8b07b7459e5e8ca16f659dbaa0ad4a7e055dd5
-
SHA256
9339df4f96d6439a812e8f080b7fe0dd6e7594ac64d66bdfc99e3b6aa1442aa9
-
SHA512
b1a1c329c00d2da4b67308529219c287e31a4de74319be580316a20ea73ed432198a5f5857a29cc3cecb74d7380764c1e38ecb1322671b72abf5c8def2dce1e0
-
SSDEEP
12288:A4/Wg5+3McbxH1yWmG2dOsG8ZoxRZ6s95r:A4j5+/xH9YQUoIs95
Malware Config
Extracted
qakbot
403.892
obama204
1663313119
119.82.111.158:443
134.35.10.207:443
200.161.62.126:32101
70.51.132.197:2222
78.100.228.93:995
78.100.225.34:2222
45.51.148.111:993
186.154.92.181:443
66.181.164.43:443
217.165.85.223:993
70.49.33.200:2222
193.3.19.37:443
41.96.56.224:443
99.232.140.205:2222
88.231.221.198:995
76.169.76.44:2222
68.53.110.74:995
196.64.237.138:443
190.44.40.48:995
72.88.245.71:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\more\veryAs.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\more\veryAs.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3672-132-0x0000000000000000-mapping.dmp
-
memory/3672-133-0x00000000006E0000-0x0000000000702000-memory.dmpFilesize
136KB
-
memory/3672-135-0x00000000006E0000-0x0000000000702000-memory.dmpFilesize
136KB
-
memory/5020-134-0x0000000000000000-mapping.dmp
-
memory/5020-136-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB
-
memory/5020-137-0x0000000000960000-0x0000000000982000-memory.dmpFilesize
136KB