Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-10-2022 08:46
General
-
Target
ComplianceReportCopy.lnk
-
Size
1KB
-
MD5
2bd5a02c25e5c84b0884290af6ecfcf6
-
SHA1
45770ea357497ffec1104d1f00dfd8314c6ed0d6
-
SHA256
0264a38354df68d37ab1679c1d4182d65a85b613d74a795b6fbf464209d4e4f1
-
SHA512
cefdd9e713d37729a3c71bd63be830de56f1ffdd7e3a0af9fe1240b9761fcf447e2ea30c9fd137908b1c8edc1b66c8ea9538f7cf489de5bfadcec29cc162251c
Malware Config
Extracted
qakbot
403.1051
obama216
1666689942
24.116.45.121:443
24.206.27.39:443
71.199.168.185:443
70.115.104.126:443
190.24.45.24:995
24.9.220.167:443
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
197.202.196.43:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ComplianceReportCopy.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c standby\overbalances.cmd regs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\debauchedBrain.comC:\Users\Admin\AppData\Local\Temp\\debauchedBrain.com standby\custom.dat3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exestandby\custom.dat4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\debauchedBrain.comFilesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
-
memory/1128-139-0x0000000000000000-mapping.dmp
-
memory/1128-141-0x0000000000940000-0x0000000000969000-memory.dmpFilesize
164KB
-
memory/1128-142-0x0000000000940000-0x0000000000969000-memory.dmpFilesize
164KB
-
memory/4928-133-0x0000000000000000-mapping.dmp
-
memory/4984-135-0x0000000000000000-mapping.dmp
-
memory/4984-136-0x0000000002FC0000-0x0000000002FE9000-memory.dmpFilesize
164KB
-
memory/4984-137-0x0000000002F60000-0x0000000002F89000-memory.dmpFilesize
164KB
-
memory/4984-138-0x0000000002FC0000-0x0000000002FE9000-memory.dmpFilesize
164KB
-
memory/4984-140-0x0000000002FC0000-0x0000000002FE9000-memory.dmpFilesize
164KB
-
memory/5048-132-0x0000000000000000-mapping.dmp