Overview

overview

10

Static

static

salute.dll

windows7-x64

10

salute.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 14:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    salute.dll

  • Size

    376KB

  • MD5

    26b404b3629f5ffe7055933a5ccf5dfd

  • SHA1

    b19da867c2f55b01814e698edae016d6beb6ef7d

  • SHA256

    5ceb3a49f47427cbbfaa09100fe1a8b7176c40c8cee24d1d42d636109276954b

  • SHA512

    f0915ba5e5bb69356ca8791b8aeea9d2ca86f64fda598963c861f23e8b40d46a87a5d7caedcd8041b5fe4af10fbd2bb80335fa211e52253d0a17008ee8a269f8

  • SSDEEP

    6144:DT1WOGkH9+qJJHMl3yifLLi0epLihYRl/r82HV9kHpjFWBk3WScv2pQdfPnb4dRG:DsRw9DJpApXQRihGl/ZL8Qg1C

Score
10/10
qakbotobama2061663660089bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.894

Botnet

obama206

Campaign

1663660089

C2

119.82.111.158:443

66.181.164.43:443

181.118.183.123:443

88.245.168.200:2222

70.49.33.200:2222

193.3.19.37:443

99.232.140.205:2222

110.4.255.247:443

134.35.9.144:443

89.211.217.38:995

64.207.215.69:443

83.110.219.59:993

197.94.84.128:443

177.255.14.99:995

41.103.226.172:443

109.155.5.164:993

190.44.40.48:995

187.205.222.100:443

41.107.78.223:995

191.97.234.238:995
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\salute.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\salute.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4856-132-0x0000000000000000-mapping.dmp
    Download
  • memory/4856-133-0x00000000012A0000-0x00000000012C2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4856-135-0x00000000012A0000-0x00000000012C2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/5112-134-0x0000000000000000-mapping.dmp
    Download
  • memory/5112-136-0x0000000000F00000-0x0000000000F22000-memory.dmp
    Filesize

    136KB

    Download
  • memory/5112-137-0x0000000000F00000-0x0000000000F22000-memory.dmp
    Filesize

    136KB

    Download