Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21-11-2022 13:28
General
-
Target
almond/proofs.dll
-
Size
490KB
-
MD5
ddbfe37ee542e01ff7e4fec440c60487
-
SHA1
22a5c14db857c9bce828cdd0a8dfce9215290435
-
SHA256
9708ef9cf4a92222375959b73000f4a92a84918ffe102c1843d2c378453a9533
-
SHA512
ad8c95867013077bf8d02dd7d73f25e060e2eb7a9886ac577ce3d93273b0445e336032ddb382a2908e5516e928337a061f1806bdc6fa849ab9a29c4e831cc971
-
SSDEEP
6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TITMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTHiwz4agFwid7e
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\proofs.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\almond\proofs.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
172KB
-
Filesize
168KB
-
Filesize
168KB