Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
21-11-2022 11:04
General
-
Target
SK.js
-
Size
9KB
-
MD5
d6a0a12caa2804fbaa1b3da762f54fa6
-
SHA1
9d5564860e326358ae66796084f9002de32a95cd
-
SHA256
aebea94d3ef23aea0c8a7276a9e9deb10c53d6fc88d4de7d12eeac04e10b1871
-
SHA512
e1480953baba5c2cddef43092567e44a6c96921b97f1aff1709d3aed4ef49cbbbf13e21d8da39fe9280b67efcb682327431dd9c8476fcf25986a0d458e4200a7
-
SSDEEP
192:cYSLj50Tavgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:E52k785UIhp/KTMhSeYmn2jiu5EjP+rs
Malware Config
Extracted
qakbot
404.30
BB06
1668752705
98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SK.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" manacle\rich.temp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exemanacle\rich.temp3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmpFilesize
8KB
-
memory/932-57-0x0000000000000000-mapping.dmp
-
memory/932-58-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/932-59-0x0000000000260000-0x000000000028A000-memory.dmpFilesize
168KB
-
memory/932-60-0x0000000000260000-0x000000000028A000-memory.dmpFilesize
168KB
-
memory/932-61-0x00000000001F0000-0x000000000021E000-memory.dmpFilesize
184KB
-
memory/932-62-0x0000000000260000-0x00000000002E0000-memory.dmpFilesize
512KB
-
memory/932-65-0x0000000000260000-0x000000000028A000-memory.dmpFilesize
168KB
-
memory/1336-55-0x0000000000000000-mapping.dmp
-
memory/2024-63-0x0000000000000000-mapping.dmp
-
memory/2024-66-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2024-67-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB