Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 13:28

General

  • Target

    carcasses/full.dll

  • Size

    561KB

  • MD5

    780c8b903eb2f4b57391c3dbe2d8ffa0

  • SHA1

    c7ef52840015e00ea49e80d7bfe5b52abfcc93ca

  • SHA256

    9eaa2e60e4285d5a36128ae4df77abb241befed30d3bbfdadc1925277e582c8a

  • SHA512

    2afdc2364ff110002ae700f488f8e1ab74007887941c9b89aed277354fe1ccd56f8c36199b75b0b3386d66ec11fe4fc9af8a913fdfb6228b003f5415a07002a8

  • SSDEEP

    6144:ypIe6W8uc0KxlK9gpC1d88LKXpAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIqv9PmgfKP1KJq

Malware Config

Extracted

Family

qakbot

Version

403.973

Botnet

BB03

Campaign

1666073717

C2

190.199.99.171:993

41.69.192.245:443

167.58.254.85:443

206.1.172.1:443

5.163.177.234:443

134.35.0.103:443

105.96.221.136:443

41.101.100.7:443

186.177.93.18:2222

78.179.135.247:443

177.205.74.14:2222

102.47.218.41:443

102.156.149.226:443

41.250.48.206:443

41.107.58.251:443

187.198.16.39:443

193.201.187.64:443

41.102.134.89:443

102.159.77.134:995

105.159.49.123:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\full.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\carcasses\full.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3724-140-0x00000000006A0000-0x00000000006C9000-memory.dmp

    Filesize

    164KB

  • memory/3724-141-0x00000000006A0000-0x00000000006C9000-memory.dmp

    Filesize

    164KB

  • memory/3872-133-0x0000000075630000-0x00000000756C0000-memory.dmp

    Filesize

    576KB

  • memory/3872-134-0x0000000075630000-0x00000000756C0000-memory.dmp

    Filesize

    576KB

  • memory/3872-135-0x00000000028F0000-0x0000000002961000-memory.dmp

    Filesize

    452KB

  • memory/3872-136-0x00000000029A0000-0x00000000029C9000-memory.dmp

    Filesize

    164KB

  • memory/3872-138-0x0000000075630000-0x00000000756C0000-memory.dmp

    Filesize

    576KB

  • memory/3872-139-0x00000000029A0000-0x00000000029C9000-memory.dmp

    Filesize

    164KB