Analysis
-
max time kernel
153s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
19-09-2022 16:46
General
-
Target
conspicuously/carotene.dll
-
Size
558KB
-
MD5
41991a38d7dc05aaad59d579f98192f5
-
SHA1
dc91f35d8e851ad6a93e0cb8e213f7df03507e43
-
SHA256
b907a30995face91bcde64f3c423cbc0b024bc320f707e931db09c51a8e8020c
-
SHA512
bb3395a322494fcbb6b1bbae9ee6879ab690a4ad4601d2a2ca8f941007bcc04e9b4af2f211a19294a7c04135dbe3e6628a359b70bbe93264feb7ade2da1ddb3a
-
SSDEEP
12288:lR7wAgTQ5KEZywqKNWL5ALmKXuSH4ZzB0T2WevB7nOb4h7j:lR7FgTQEEwwZNWOLmKz4Zzq2lQ07j
Malware Config
Extracted
qakbot
403.894
obama205
1663572656
41.97.76.61:443
119.82.111.158:443
193.3.19.37:443
70.49.33.200:2222
66.181.164.43:443
109.155.5.164:993
99.232.140.205:2222
78.100.228.93:995
64.207.215.69:443
134.35.13.201:443
86.98.156.218:993
177.255.14.99:995
68.224.229.42:443
190.44.40.48:995
187.205.222.100:443
41.111.77.115:995
196.64.239.93:443
100.1.5.250:995
194.166.205.204:995
88.232.207.24:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\conspicuously\carotene.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\conspicuously\carotene.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/32-132-0x0000000000000000-mapping.dmp
-
memory/32-133-0x0000000002B30000-0x0000000002B52000-memory.dmpFilesize
136KB
-
memory/32-135-0x0000000002B30000-0x0000000002B52000-memory.dmpFilesize
136KB
-
memory/3280-134-0x0000000000000000-mapping.dmp
-
memory/3280-136-0x0000000000750000-0x0000000000772000-memory.dmpFilesize
136KB
-
memory/3280-137-0x0000000000750000-0x0000000000772000-memory.dmpFilesize
136KB