Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    167s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 13:28

General

  • Target

    Originals.lnk

  • Size

    1KB

  • MD5

    5b20c4ff2f74fb557d2b6dc004285231

  • SHA1

    ed30fd4d056500060e467898c33f7d51e15a451d

  • SHA256

    88cf6c638b912634731c94007ae470e5ca426ab2ef0d455335f4d17c8cd63e5b

  • SHA512

    39caac70327860981172054ff7ea62623cc6037bdbde6de4568bfa9046136e382e8685c2c4fcdf6435168f2e6de9cf03b8dab09d9765265abe29e27bf8b3a52d

Malware Config

Extracted

Family

qakbot

Version

403.973

Botnet

BB03

Campaign

1666073717

C2

190.199.99.171:993

41.69.192.245:443

167.58.254.85:443

206.1.172.1:443

5.163.177.234:443

134.35.0.103:443

105.96.221.136:443

41.101.100.7:443

186.177.93.18:2222

78.179.135.247:443

177.205.74.14:2222

102.47.218.41:443

102.156.149.226:443

41.250.48.206:443

41.107.58.251:443

187.198.16.39:443

193.201.187.64:443

41.102.134.89:443

102.159.77.134:995

105.159.49.123:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Originals.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c carcasses\imams.cmd re gs vr
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\bbc.exe
        C:\Users\Admin\AppData\Local\Temp\bbc.exe carcasses\full.des
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\regsvr32.exe
          carcasses\full.des
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bbc.exe

    Filesize

    24KB

    MD5

    b0c2fa35d14a9fad919e99d9d75e1b9e

    SHA1

    8d7c2fd354363daee63e8f591ec52fa5d0e23f6f

    SHA256

    022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7

    SHA512

    a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022

  • memory/1528-136-0x00000000756B0000-0x0000000075740000-memory.dmp

    Filesize

    576KB

  • memory/1528-137-0x00000000756B0000-0x0000000075740000-memory.dmp

    Filesize

    576KB

  • memory/1528-138-0x0000000002390000-0x0000000002401000-memory.dmp

    Filesize

    452KB

  • memory/1528-139-0x0000000002890000-0x00000000028B9000-memory.dmp

    Filesize

    164KB

  • memory/1528-142-0x0000000002890000-0x00000000028B9000-memory.dmp

    Filesize

    164KB

  • memory/1528-143-0x00000000756B0000-0x0000000075740000-memory.dmp

    Filesize

    576KB

  • memory/2032-141-0x0000000000540000-0x0000000000569000-memory.dmp

    Filesize

    164KB