Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
17-11-2022 16:52
General
-
Target
port/harmonica.dll
-
Size
691KB
-
MD5
90103b12495b7769cdea460b9b20fa03
-
SHA1
b3da0cb63f2f0329f63cd36e2d92dc78d35aeaba
-
SHA256
bf628dba02d4181a7c5fc10f67b99c4e26b13a92ea92470f38adc4e57886b2fc
-
SHA512
af5fb4e7f79a0365aba33e38a83041e1431d976352b1505c0e3aebbcdb6bf730b5a37bc5e930150913aea612120be7a8eb94db9dbc5b58901c6fff14c5b8e0b1
-
SSDEEP
12288:sjGfBl5YUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjkLW8wWpD9u/VLM9Xq4n
Malware Config
Extracted
qakbot
404.30
BB06
1668683197
23.240.47.58:995
12.172.173.82:465
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
83.114.60.6:2222
86.171.75.63:443
86.195.32.149:2222
170.253.25.35:443
92.185.204.18:2078
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
116.74.163.152:443
76.80.180.154:995
180.151.104.143:443
86.130.9.167:2222
86.99.15.243:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\port\harmonica.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\port\harmonica.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
460KB
-
Filesize
168KB
-
Filesize
168KB