Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
15-11-2022 19:10
General
-
Target
inducted/muscovite.dll
-
Size
624KB
-
MD5
fc142a16019f2992180c59ed2c9d8d4f
-
SHA1
259fbdcbb0a00ea5eff3c9c6afc57badb6714da6
-
SHA256
3792788f81cceea69a5b82930fd2515984c6c058195e8fef97ce678a59f770af
-
SHA512
652f8e2b5535f69facce3917c5b32ee920d63c647da238d47450642b2bcbd761cdfc286bfa06012d927600e6d899fd98a5dcbdb57dfbe15c0b39fc8c9e62674d
-
SSDEEP
12288:i/TGcg+w9KCfJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H:i/TGckKCf30IAIQR3O7OjHHAp
Malware Config
Extracted
qakbot
404.27
BB06
1668492308
49.175.72.56:443
81.229.117.95:2222
47.41.154.250:443
69.133.162.35:443
84.35.26.14:995
68.47.128.161:443
156.217.219.147:995
87.65.160.87:995
174.101.111.4:443
82.127.174.33:2222
91.169.12.198:32100
24.28.121.122:443
157.231.42.190:995
90.89.95.158:2222
74.33.84.227:443
24.64.114.59:2222
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
170.253.25.35:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\inducted\muscovite.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\inducted\muscovite.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
184KB
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB