Analysis

  • max time kernel
    150s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2022 15:40

General

  • Target

    erratically.dll

  • Size

    374KB

  • MD5

    2dd968e237d620ccc825a2c24039b2af

  • SHA1

    d2b86dde849f521e18769a108b56829878b09b7f

  • SHA256

    87234473b02963f9a102dd1b42f743c050faf79f15379508ed2faa90a294261f

  • SHA512

    a16736ccea445b1f2fb799b3855ed96cc8ced3bb18dbf07d8ae45d81b973cbe03f28e6aaaf678e60903ce447163619a798155a68cfed002ced05b9a6a79804af

  • SSDEEP

    6144:XKR66t98Uah1oq7PbQIIJSLiyCE0taaRIC6w/9IAFK+20m6WdMxgYURpi92H4X:w6E1YF7P01JSdCLjqa/94NdMxgligH8

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\erratically.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\erratically.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/832-60-0x0000000000000000-mapping.dmp

  • memory/832-62-0x0000000000090000-0x00000000000BA000-memory.dmp

    Filesize

    168KB

  • memory/832-63-0x0000000000090000-0x00000000000BA000-memory.dmp

    Filesize

    168KB

  • memory/1532-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

    Filesize

    8KB

  • memory/1628-55-0x0000000000000000-mapping.dmp

  • memory/1628-56-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

    Filesize

    8KB

  • memory/1628-57-0x0000000000210000-0x000000000023A000-memory.dmp

    Filesize

    168KB

  • memory/1628-58-0x0000000000210000-0x000000000023A000-memory.dmp

    Filesize

    168KB

  • memory/1628-59-0x00000000001E0000-0x0000000000260000-memory.dmp

    Filesize

    512KB