Analysis
- max time kernel
149s - max time network
45s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
01/11/2022, 01:22
General
- Target CO.lnk
- Size 1KB
- Sample221101-brdvgafgfl
- SHA256 5df2756a7d76d95678704d977c845838e8e3d9829303cbacf6862992824de4bc
Malware Config
Extracted
-
qakbot
-
404.14
-
BB05
-
1667208557
-
174.77.209.5:443
-
187.0.1.74:23795
-
24.206.27.39:443
-
1.156.220.169:30723
-
156.216.39.119:995
-
58.186.75.42:443
-
1.156.197.160:30467
-
187.1.1.190:4844
-
186.18.210.16:443
-
1.181.56.171:771
-
90.165.109.4:2222
-
187.0.1.186:39742
-
87.57.13.215:443
-
187.0.1.207:52344
-
227.26.3.227:1
-
98.207.190.55:443
-
187.0.1.197:7017
-
188.49.56.189:443
-
102.156.160.115:443
-
187.0.1.24:17751
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CO.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c judicature\unfurled.cmd reg2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\regsvr32.exejudicature\stereotypes.dat1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\infertilityRevelry.comC:\Users\Admin\AppData\Local\Temp\\infertilityRevelry.com judicature\stereotypes.dat1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
infertilityRevelry.com
infertilityRevelry.com
memory/700-103-0x0000000000750000-0x000000000077A000-memory.dmp
memory/700-101-0x0000000000750000-0x000000000077A000-memory.dmp
memory/700-106-0x0000000000750000-0x000000000077A000-memory.dmp
memory/700-97-0x00000000751A1000-0x00000000751A3000-memory.dmp
memory/700-98-0x0000000000A31000-0x0000000000B68000-memory.dmp
memory/700-99-0x0000000000750000-0x000000000077A000-memory.dmp
memory/700-102-0x00000000002B0000-0x00000000002DA000-memory.dmp
memory/700-100-0x0000000000750000-0x000000000077A000-memory.dmp
memory/1148-107-0x0000000000080000-0x00000000000AA000-memory.dmp
memory/1148-108-0x0000000000080000-0x00000000000AA000-memory.dmp
memory/1960-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp