Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
19-09-2022 16:46
General
-
Target
conspicuously/carotene.dll
-
Size
558KB
-
MD5
41991a38d7dc05aaad59d579f98192f5
-
SHA1
dc91f35d8e851ad6a93e0cb8e213f7df03507e43
-
SHA256
b907a30995face91bcde64f3c423cbc0b024bc320f707e931db09c51a8e8020c
-
SHA512
bb3395a322494fcbb6b1bbae9ee6879ab690a4ad4601d2a2ca8f941007bcc04e9b4af2f211a19294a7c04135dbe3e6628a359b70bbe93264feb7ade2da1ddb3a
-
SSDEEP
12288:lR7wAgTQ5KEZywqKNWL5ALmKXuSH4ZzB0T2WevB7nOb4h7j:lR7FgTQEEwwZNWOLmKz4Zzq2lQ07j
Malware Config
Extracted
qakbot
403.894
obama205
1663572656
41.97.76.61:443
119.82.111.158:443
193.3.19.37:443
70.49.33.200:2222
66.181.164.43:443
109.155.5.164:993
99.232.140.205:2222
78.100.228.93:995
64.207.215.69:443
134.35.13.201:443
86.98.156.218:993
177.255.14.99:995
68.224.229.42:443
190.44.40.48:995
187.205.222.100:443
41.111.77.115:995
196.64.239.93:443
100.1.5.250:995
194.166.205.204:995
88.232.207.24:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\conspicuously\carotene.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\conspicuously\carotene.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1292-60-0x0000000000000000-mapping.dmp
-
memory/1292-62-0x00000000746B1000-0x00000000746B3000-memory.dmpFilesize
8KB
-
memory/1292-64-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1292-65-0x0000000000080000-0x00000000000A2000-memory.dmpFilesize
136KB
-
memory/1928-55-0x0000000000000000-mapping.dmp
-
memory/1928-56-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1928-57-0x0000000000190000-0x00000000001B2000-memory.dmpFilesize
136KB
-
memory/1928-59-0x0000000000190000-0x00000000001B2000-memory.dmpFilesize
136KB
-
memory/1928-63-0x0000000000190000-0x00000000001B2000-memory.dmpFilesize
136KB
-
memory/1972-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB