Analysis

  • max time kernel
    151s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 22:15

General

  • Target

    Contract.lnk

  • Size

    1KB

  • MD5

    ad079ab2d276ebb2d1fd21c312470961

  • SHA1

    d0df3afa594bfecfcf11cb93c2847462d6a1d661

  • SHA256

    2525a45f8cd187363a9de42cbf14bc00c6d77ddb28246169a1dfa01a89cd9a9c

  • SHA512

    14e5f59fddb33efa78b698e31706b9125c135f545c78ed6977f3bb571cd059f5b4e723ccf7ab1f1444a4dc68cef825094e33449cc2c49f4526d4c89765215493

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

BB04

Campaign

1666265103

C2

102.156.82.38:995

152.170.17.136:443

216.131.22.236:995

70.173.248.13:443

14.246.151.175:443

160.179.32.101:995

118.175.242.26:995

186.188.80.202:443

41.69.181.145:443

156.220.14.160:993

201.68.209.47:32101

206.1.172.1:443

156.217.185.90:995

190.74.4.20:443

217.78.49.161:443

154.181.199.80:995

200.233.108.153:993

175.205.2.54:443

198.2.51.242:993

181.164.194.228:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Contract.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c liveried\waddling.cmd reg sv r
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\6.exe
        C:\Users\Admin\AppData\Local\Temp\6.exe liveried\sufferer.ssd
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\SysWOW64\regsvr32.exe
          liveried\sufferer.ssd
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:756
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1524

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6.exe

    Filesize

    19KB

    MD5

    59bce9f07985f8a4204f4d6554cff708

    SHA1

    645c424974fbe5fe7a04cac73f1c23c96e1570b8

    SHA256

    ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

    SHA512

    3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

  • \Users\Admin\AppData\Local\Temp\6.exe

    Filesize

    19KB

    MD5

    59bce9f07985f8a4204f4d6554cff708

    SHA1

    645c424974fbe5fe7a04cac73f1c23c96e1570b8

    SHA256

    ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57

    SHA512

    3cf5825a9c7fb80ea0bd36775a92d07f34cd3709ed2c7c8f500f1c8baa5242768f6d575bd2477b77e3f177e7a4994d5c5bddb24c6eb43b60a6bd83ea026a8198

  • memory/756-99-0x0000000000430000-0x0000000000459000-memory.dmp

    Filesize

    164KB

  • memory/756-100-0x0000000000430000-0x0000000000459000-memory.dmp

    Filesize

    164KB

  • memory/756-107-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/756-97-0x0000000075451000-0x0000000075453000-memory.dmp

    Filesize

    8KB

  • memory/756-98-0x0000000001EE0000-0x0000000001F83000-memory.dmp

    Filesize

    652KB

  • memory/756-104-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

  • memory/756-103-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

  • memory/756-101-0x0000000000430000-0x0000000000459000-memory.dmp

    Filesize

    164KB

  • memory/756-102-0x00000000002D0000-0x00000000002F9000-memory.dmp

    Filesize

    164KB

  • memory/1524-108-0x0000000000080000-0x00000000000A9000-memory.dmp

    Filesize

    164KB

  • memory/1524-109-0x0000000000080000-0x00000000000A9000-memory.dmp

    Filesize

    164KB

  • memory/2020-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

    Filesize

    8KB