Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
18-11-2022 19:37
General
-
Target
debunked/commutative.dll
-
Size
374KB
-
MD5
3b3b0b2efd59eb1d0dd2655f36a3afc4
-
SHA1
09e317d0b3ef42771bbbbb40d99d6e740f73fb7e
-
SHA256
282bc9b38457cba003c8f80751e9d1a9aa410c5e245ef3666ad48937a8063e6d
-
SHA512
5dd89407375265a646b7aa889669b161172eada2e8220cec7ce6f7f5479bf60ded55c8061e034f6f4e0e7c077937cbffaa8921264e5b7c6f4d08b4a1bd9c6fef
-
SSDEEP
6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9I+FK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/9ONdMxgligH8
Malware Config
Extracted
qakbot
404.30
obama223
1668757345
68.47.128.161:443
87.65.160.87:995
172.90.139.138:2222
86.175.128.143:443
12.172.173.82:465
71.247.10.63:2083
47.41.154.250:443
91.254.215.167:443
71.31.101.183:443
81.229.117.95:2222
24.4.239.157:443
41.99.177.175:443
92.149.205.238:2222
73.230.28.7:443
47.229.96.60:443
186.188.2.193:443
174.112.25.29:2078
84.35.26.14:995
86.130.9.167:2222
116.74.163.221:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\debunked\commutative.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\debunked\commutative.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
184KB
-
Filesize
168KB
-
Filesize
168KB