Analysis
-
max time kernel
171s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19-09-2022 08:52
General
-
Target
of/becauseBecause.dll
-
Size
482KB
-
MD5
95c72c221343864a3a7d2bcbc03bce98
-
SHA1
c7d9e379eb9054092778f06066536f26379be173
-
SHA256
c53628e9a3d52b4236269209f57f941231ab89c4cc6c75a57a2abd95430fda7a
-
SHA512
d81ea80a10ecb342f204dfcd7384bc5eaa798c4dd30aeb8b756619a5ffa22650a47a2045c6c88bea8050835f1cda51893ecc3285348fe0e00c9fcf6e48559935
-
SSDEEP
12288:u1qupWltwUuRQkQrO6qbIE3yM73wUYhiEq:uWtwQbrXq3ym1GP
Malware Config
Extracted
qakbot
403.894
BB
1663336370
68.53.110.74:995
70.51.132.197:2222
78.100.228.93:995
78.100.225.34:2222
200.161.62.126:32101
179.111.111.88:32101
41.96.234.120:443
99.232.140.205:2222
105.99.213.235:995
217.165.68.125:993
88.231.221.198:995
193.3.19.37:443
70.49.33.200:2222
31.54.39.153:2078
102.38.97.72:995
119.82.111.158:443
134.35.10.207:443
45.51.148.111:993
186.154.92.181:443
66.181.164.43:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\of\becauseBecause.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\of\becauseBecause.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
136KB
-
Filesize
136KB