Analysis

  • max time kernel
    150s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2022 06:26

General

  • Target

    ContractCopy.js

  • Size

    9KB

  • MD5

    599ff2df10ec1a8497d760784e493885

  • SHA1

    0b6342b8c43c76fbde2e714c2a7cda2bd1260d05

  • SHA256

    fbe4408e0c0a528f331fc002f785eff7ad16f45ae3ea3ab94eb8b3cbf0c6f00f

  • SHA512

    08e93e1117220b0edc589505e5d3bba99c408deb5d9ce197df864cecf838a815850d9b3a0d5c6fef9ab86396bf5af230c9b1f58f3fdbfeb7db339f97bbc15dd5

  • SSDEEP

    192:GSLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:BVq2k785UIro8KTMhSeYm5P2jiuuEjP4

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama222

Campaign

1668692319

C2

105.184.161.242:443

73.36.196.11:443

82.31.37.241:443

24.116.45.121:443

213.67.255.57:2222

200.93.14.206:2222

188.54.79.88:995

87.220.205.14:2222

72.88.245.71:443

92.137.74.174:2222

91.68.227.219:443

184.153.132.82:443

74.66.134.24:443

47.16.73.77:2222

41.97.183.39:443

177.205.92.100:2222

24.64.114.59:3389

105.111.45.51:995

86.180.222.237:2222

76.184.95.190:993

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ContractCopy.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" addled\soloists.tmp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\regsvr32.exe
        addled\soloists.tmp
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Windows\SysWOW64\wermgr.exe
          C:\Windows\SysWOW64\wermgr.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-68-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB

  • memory/828-67-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB

  • memory/1580-61-0x0000000000A90000-0x0000000000ABA000-memory.dmp

    Filesize

    168KB

  • memory/1580-60-0x0000000000A10000-0x0000000000A83000-memory.dmp

    Filesize

    460KB

  • memory/1580-62-0x0000000074CB0000-0x0000000074D77000-memory.dmp

    Filesize

    796KB

  • memory/1580-59-0x0000000074CB0000-0x0000000074D77000-memory.dmp

    Filesize

    796KB

  • memory/1580-65-0x0000000074CB0000-0x0000000074D77000-memory.dmp

    Filesize

    796KB

  • memory/1580-66-0x0000000000A90000-0x0000000000ABA000-memory.dmp

    Filesize

    168KB

  • memory/1580-58-0x0000000076191000-0x0000000076193000-memory.dmp

    Filesize

    8KB

  • memory/1748-54-0x000007FEFC171000-0x000007FEFC173000-memory.dmp

    Filesize

    8KB