Resubmissions
26/10/2022, 15:38
221026-s3c6ragba6 10Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/10/2022, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
qbot.dll
Resource
win7-20220812-en
General
-
Target
qbot.dll
-
Size
502KB
-
MD5
a4e2d9a3da5ce54d2fc19c996757b86a
-
SHA1
ce44ba7151528ca73be82737ea142dc5e76394b7
-
SHA256
dbddf15af96147af422ab24fe6d8b5ef06af06a0a8d41362db8edd400f778546
-
SHA512
e52f13ab245121b45d4f5e110cd0aa4d0c8e83c59a9b4f8e3457df41d254bacb6cd5b3c2bc50c6f4a7125b8a23870de358d0f917ea65b1e5f820a83003f9964d
-
SSDEEP
6144:KSGYaRyE5Na5otGQkAVFOaqyrGAO87yH3pkNNUoGMHbn/WRCGxIIcAB:DGYGvMc5EyKi70YNUoj7iB
Malware Config
Extracted
qakbot
403.1051
BB04
1666690935
181.164.194.228:443
24.116.45.121:443
190.74.248.136:443
24.206.27.39:443
27.110.134.202:995
2.88.206.121:443
71.199.168.185:443
200.233.108.153:995
198.2.51.242:993
172.117.139.142:995
70.115.104.126:443
144.202.15.58:443
190.24.45.24:995
24.9.220.167:443
58.247.115.126:995
193.3.19.137:443
45.230.169.132:995
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
201.68.209.47:32101
190.33.241.216:443
156.197.230.148:995
197.202.196.43:443
175.205.2.54:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
200.233.108.153:993
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
189.216.29.135:443
191.84.65.116:443
186.14.70.229:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 regsvr32.exe 5012 regsvr32.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe 452 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5012 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4416 wrote to memory of 5012 4416 regsvr32.exe 83 PID 4416 wrote to memory of 5012 4416 regsvr32.exe 83 PID 4416 wrote to memory of 5012 4416 regsvr32.exe 83 PID 5012 wrote to memory of 452 5012 regsvr32.exe 92 PID 5012 wrote to memory of 452 5012 regsvr32.exe 92 PID 5012 wrote to memory of 452 5012 regsvr32.exe 92 PID 5012 wrote to memory of 452 5012 regsvr32.exe 92 PID 5012 wrote to memory of 452 5012 regsvr32.exe 92
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\qbot.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\qbot.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:452
-
-