Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21-11-2022 10:33
General
-
Target
manacle/superabundance.dll
-
Size
372KB
-
MD5
3ecc93f9d6b41e0c4e6da80a20991527
-
SHA1
8841f8599bcd0011ffbae4be617b8f7a48101296
-
SHA256
90f29b440ee2a2163dcaa1e10719a325b9569e8e43f14be017343922f6901d0c
-
SHA512
6c5a3e6d3c1888df22227055f5d289c8aa94051812d9a1c34e6ec093954cb9a1ec2360f18c3ba44eaf1bd0c1a3a99e6293d3ae7fd226d45060a1e6b2b4369623
-
SSDEEP
6144:l1eKK1u77wiWjvM9gaYhWawPSxipTR9K1/XAeDA+sqKD9oqHs9Dz/RJhKXuz:mKzMD2gaSWcxITi/XAZ+s7pohvRJhr
Malware Config
Extracted
qakbot
404.30
BB06
1668752705
98.147.155.235:443
49.175.72.56:443
82.31.37.241:443
73.36.196.11:443
2.84.98.228:2222
188.54.79.88:995
184.153.132.82:443
74.66.134.24:443
172.117.139.142:995
12.172.173.82:990
24.64.114.59:3389
12.172.173.82:2087
78.92.133.215:443
24.64.114.59:2222
50.68.204.71:995
105.184.161.242:443
12.172.173.82:22
221.161.103.6:443
98.145.23.67:443
73.161.176.218:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\manacle\superabundance.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\manacle\superabundance.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
184KB
-
Filesize
168KB
-
Filesize
168KB