Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
18-11-2022 10:25
General
-
Target
rotisserie.dll
-
Size
781KB
-
MD5
2c1372d4ec8dbcfa9c66c81cddc2bac6
-
SHA1
e67a49d2a83fa6fbaf68d4b450429e8717ef5462
-
SHA256
90356f54173e913819f0df924d47554832d00b524abf103b218ca19783106652
-
SHA512
693bd1aa114f4b60cd7371410f620af661c77d0a83fc6da6bbc29fd9d7bd742c6e0f351ad5c7018ee8d04a8ca1a4f38d0b48a6ffa779b5bd9c3864b39f009609
-
SSDEEP
12288:3+ed7zMD42lTz4kgXWdf8+wawM375RGyin7ZlUP9XqcYX:Zd7QUoTzEWdfwTTn3M9XqdX
Malware Config
Extracted
qakbot
404.30
obama222
1668692319
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
188.54.79.88:995
87.220.205.14:2222
72.88.245.71:443
92.137.74.174:2222
91.68.227.219:443
184.153.132.82:443
74.66.134.24:443
47.16.73.77:2222
41.97.183.39:443
177.205.92.100:2222
24.64.114.59:3389
105.111.45.51:995
86.180.222.237:2222
76.184.95.190:993
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\rotisserie.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\rotisserie.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
460KB
-
Filesize
168KB
-
Filesize
796KB
-
Filesize
168KB