Overview

overview

10

Static

static

OB76.zip

windows10-2004-x64

10

Resubmissions

18-11-2022 20:46

221118-zklhqsbg7w 10

18-11-2022 20:45

221118-zjph1abg4y 1

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2022 20:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    OB76.zip

  • Size

    362KB

  • MD5

    f860cc2f0664f9a86d87058f02aa8a42

  • SHA1

    b37f6be3df4e13f0183ef586bba5e4a42924a675

  • SHA256

    4153a179adec63180997585a07dcd08b374781ca73c3b649173976d3d0078b96

  • SHA512

    64c434edb56d3d056d27b82d750054ea9a4011587e8f97cb3b4be8365b7fed6b25c6676de2920c9e01a0a091199b2b3c0da3e7b8788bd3f0be65f68070378c0b

  • SSDEEP

    6144:ggFfJcxQP84hPdO+cDA9W1KcPmo4DryTFSX+5yBY9IF+g173Bqo5C2PzIvy88c:gg1JrP84hPdhcq0mokycuAuOxB3k2Pzo

Score
10/10
qakbotbb061668752705bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668752705

C2

98.147.155.235:443

49.175.72.56:443

82.31.37.241:443

73.36.196.11:443

2.84.98.228:2222

188.54.79.88:995

184.153.132.82:443

74.66.134.24:443

172.117.139.142:995

12.172.173.82:990

24.64.114.59:3389

12.172.173.82:2087

78.92.133.215:443

24.64.114.59:2222

50.68.204.71:995

105.184.161.242:443

12.172.173.82:22

221.161.103.6:443

98.145.23.67:443

73.161.176.218:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\OB76.zip
    1⤵
      PID:4300
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3260
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\OB76\" -spe -an -ai#7zMap23255:88:7zEvent14415
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:724
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "E:\SK.js"
        1⤵
        • Checks computer location settings
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\System32\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" manacle\wined.temp
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4644
          • C:\Windows\SysWOW64\regsvr32.exe
            manacle\wined.temp
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3052
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3572
      • C:\Windows\System32\Notepad.exe
        "C:\Windows\System32\Notepad.exe" E:\SK.js
        1⤵
        • Enumerates connected drives
        PID:4916

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3052-133-0x0000000000000000-mapping.dmp
        Download
      • memory/3052-134-0x0000000000E60000-0x0000000000E8E000-memory.dmp
        Filesize

        184KB

        Download
      • memory/3052-135-0x0000000000E90000-0x0000000000EBA000-memory.dmp
        Filesize

        168KB

        Download
      • memory/3052-138-0x0000000000E90000-0x0000000000EBA000-memory.dmp
        Filesize

        168KB

        Download
      • memory/3572-136-0x0000000000000000-mapping.dmp
        Download
      • memory/3572-137-0x0000000000110000-0x000000000013A000-memory.dmp
        Filesize

        168KB

        Download
      • memory/3572-139-0x0000000000110000-0x000000000013A000-memory.dmp
        Filesize

        168KB

        Download
      • memory/4644-132-0x0000000000000000-mapping.dmp
        Download