Analysis

  • max time kernel
    149s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2022 10:39

General

  • Target

    animators/slice.dll

  • Size

    835KB

  • MD5

    8b46c51c1c16214456ecf543f2c5f473

  • SHA1

    682bbd33e17e1885b8d7d89a80e7b803322c23d8

  • SHA256

    6e0adb73b6c18ad39ba761bdd0099dcffc56269253714deb7a9b5dcc103693ba

  • SHA512

    53d5aa471abc4604490a090e0dea41b30f1aad0df561973346eb4b37ad264d5bad546daa9e688bd01560aed79d2a33dbe8aee29a5a573bab32b4327458b4c5a3

  • SSDEEP

    12288:T6F+DfZxL4+Dir8lkQ5z4hbImKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhUp2QOU

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668670510

C2

86.225.214.138:2222

71.183.236.133:443

182.66.197.35:443

70.66.199.12:443

76.80.180.154:995

180.151.104.143:443

92.149.205.238:2222

83.110.223.247:443

183.87.31.34:443

105.103.50.1:990

103.141.50.117:995

105.103.50.1:465

105.103.50.1:22

86.130.9.167:2222

86.99.15.243:2222

90.104.22.28:2222

172.117.139.142:995

176.142.207.63:443

142.161.27.232:2222

71.247.10.63:50003

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Extracted

Family

qakbot

Attributes
  • salt

    ~�w%��N$���0��U��J��m�/(

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\animators\slice.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\animators\slice.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/268-62-0x0000000000000000-mapping.dmp

  • memory/268-64-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB

  • memory/268-65-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB

  • memory/860-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

    Filesize

    8KB

  • memory/1344-55-0x0000000000000000-mapping.dmp

  • memory/1344-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB

  • memory/1344-57-0x00000000001E0000-0x000000000020A000-memory.dmp

    Filesize

    168KB

  • memory/1344-58-0x00000000001E0000-0x000000000020A000-memory.dmp

    Filesize

    168KB

  • memory/1344-59-0x00000000001B0000-0x0000000000230000-memory.dmp

    Filesize

    512KB

  • memory/1344-60-0x00000000001B0000-0x0000000000230000-memory.dmp

    Filesize

    512KB

  • memory/1344-61-0x00000000001B0000-0x0000000000230000-memory.dmp

    Filesize

    512KB