Analysis
-
max time kernel
165s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19-09-2022 08:52
General
-
Target
more/wouldDay.dll
-
Size
484KB
-
MD5
af4cbaadd04245f0b369e0d8ef70b1e9
-
SHA1
716929571dce5392ab807e245c173e7db3958c14
-
SHA256
99c6a890e51789f07a0e1f8d626e60ee5b4cb2eaf91ece3b5d0b13f21ea07cee
-
SHA512
7110a1187c68be37d7a4e8745983f18fbed87a5301facaefde6b32e4bfafe9e7c00596151f18b29e1d8bb75a6ab9490f4508a94e8aacf85308ee18f22f829ccc
-
SSDEEP
12288:A4/Wg5+3Mcb5H1yWmG2dOsG8ZoxRZ6s95r:A4j5+/5H9YQUoIs95
Malware Config
Extracted
qakbot
403.892
obama204
1663313119
119.82.111.158:443
134.35.10.207:443
200.161.62.126:32101
70.51.132.197:2222
78.100.228.93:995
78.100.225.34:2222
45.51.148.111:993
186.154.92.181:443
66.181.164.43:443
217.165.85.223:993
70.49.33.200:2222
193.3.19.37:443
41.96.56.224:443
99.232.140.205:2222
88.231.221.198:995
76.169.76.44:2222
68.53.110.74:995
196.64.237.138:443
190.44.40.48:995
72.88.245.71:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\more\wouldDay.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\more\wouldDay.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
136KB
-
Filesize
136KB