Overview

overview

10

Static

static

0b2de008-e...de.zip

windows7-x64

1

0b2de008-e...de.zip

windows10-2004-x64

10

Resubmissions

16-11-2022 12:08

221116-pa4w8aed3w 10

16-11-2022 12:05

221116-n9fg8sad67 1

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2022 12:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b2de008-e828-4d57-921b-3b939ee621de.zip

  • Size

    433KB

  • MD5

    10fe31576a786ad193ece260351ab4db

  • SHA1

    cac60c023a04a913a9131bd65ded26f0c1a46dbc

  • SHA256

    184f9484299a3227430041acb86c82af3a89f78633599ed6c3afe66e61900ed7

  • SHA512

    ed8773ac03d26f1a8e3eb69de795edba373ad4d1c3547919ee91508ef23da260e33c9195ec763578b4fc992739e73f4fd45f9d105294945f343cb0db40576ab6

  • SSDEEP

    6144:6kzidwF+C9ClTzYqtmZkKPr3MXb27e7NfZ3997Fom4941K024aeyjGLlV1nl++3r:vzi/C9INtmZN7Ea7INZNgm6CNyjsL+qr

Score
10/10
qakbotobama2211667915095bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

obama221

Campaign

1667915095

C2

199.83.165.233:443

24.142.218.202:443

79.166.120.168:995

92.24.200.226:995

151.32.168.124:443

72.88.245.71:443

46.229.194.17:443

142.119.40.220:2222

177.205.114.49:2222

174.104.184.149:443

86.167.26.227:2222

94.15.58.251:443

82.155.111.187:443

2.84.98.228:2222

69.133.162.35:443

92.189.214.236:2222

190.74.23.139:443

47.34.30.133:443

80.103.77.44:2222

82.34.170.37:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\0b2de008-e828-4d57-921b-3b939ee621de.zip
    1⤵
      PID:2096
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1940
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c control.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2196
        • \??\E:\control.exe
          control.exe
          2⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Windows\SysWOW64\regsvr32.exe
            C:\Windows\SysWOW64\regsvr32.exe msoffice32.dll
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2096
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1112
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:3892
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c control.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:1536
          • \??\E:\control.exe
            control.exe
            2⤵
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3916
            • C:\Windows\SysWOW64\regsvr32.exe
              C:\Windows\SysWOW64\regsvr32.exe msoffice32.dll
              3⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Windows\SysWOW64\wermgr.exe
                C:\Windows\SysWOW64\wermgr.exe
                4⤵
                  PID:5008
          • C:\Windows\SysWOW64\DllHost.exe
            C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
            1⤵
              PID:3484

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/940-132-0x0000000000000000-mapping.dmp

              Download

            • memory/2096-136-0x0000000000000000-mapping.dmp

              Download

            • memory/2096-139-0x0000000000BC0000-0x0000000000BEA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/2096-138-0x0000000000BC0000-0x0000000000BEA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/2232-141-0x0000000000000000-mapping.dmp

              Download

            • memory/2232-142-0x0000000002BD0000-0x0000000002BFA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/2232-145-0x0000000002BD0000-0x0000000002BFA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/3144-137-0x0000000001330000-0x000000000135A000-memory.dmp

              Filesize

              168KB

              Download

            • memory/3144-135-0x0000000001330000-0x000000000135A000-memory.dmp

              Filesize

              168KB

              Download

            • memory/3144-134-0x0000000001300000-0x000000000132E000-memory.dmp

              Filesize

              184KB

              Download

            • memory/3144-133-0x0000000000000000-mapping.dmp

              Download

            • memory/3916-140-0x0000000000000000-mapping.dmp

              Download

            • memory/5008-143-0x0000000000000000-mapping.dmp

              Download

            • memory/5008-144-0x0000000000460000-0x000000000048A000-memory.dmp

              Filesize

              168KB

              Download