Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
21-11-2022 12:58
General
-
Target
almond/mole.dll
-
Size
490KB
-
MD5
f6d6dc18fcd618ca9e058edc1b8ba83d
-
SHA1
34af27a7631257bd758bbedcee4b9603d4edbef7
-
SHA256
94eca9416959a810b8a32207460879706b7d85ecd1e12eea228deeeef19bf2e0
-
SHA512
1afeff82a74dc6961171fdf025567383e50add1c0abadbd57087e8f81cca753acbe1a97ca92f19b1128708da0ea98329f37439c41c9ac231db7cfdb1c13d787b
-
SSDEEP
6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TIXMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhT7iwz4agFwid7e
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\mole.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\almond\mole.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
8KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB