Analysis
-
max time kernel
178s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21-11-2022 16:30
General
-
Target
JG.js
-
Size
10KB
-
MD5
d314b639c98ad565631678f325359a36
-
SHA1
e419b4483754e028e06bd21452e379a01e750386
-
SHA256
4d74a1803c53dffeaf4026b184618ef6d52be2ba254a4073890d1e2a201d62e6
-
SHA512
8e063db2c016079aef4e6c209140568def6aee2e5e04ab19951cc3b84ab5ea0a4dba515a6c518ba278e54d0a624d227f73fccbe6dceef5ee1ad24cb12a30df2a
-
SSDEEP
192:7GpSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5AJ:7GU5Kk785UIhp/KTMhSeYmn2jiu5EjPH
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\JG.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" almond\wispy.temp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exealmond\wispy.temp3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/264-136-0x0000000000000000-mapping.dmp
-
memory/264-138-0x0000000000CA0000-0x0000000000CCA000-memory.dmpFilesize
168KB
-
memory/264-139-0x0000000000CA0000-0x0000000000CCA000-memory.dmpFilesize
168KB
-
memory/2164-133-0x0000000000000000-mapping.dmp
-
memory/2164-134-0x0000000000B40000-0x0000000000B6B000-memory.dmpFilesize
172KB
-
memory/2164-135-0x0000000000B70000-0x0000000000B9A000-memory.dmpFilesize
168KB
-
memory/2164-137-0x0000000000B70000-0x0000000000B9A000-memory.dmpFilesize
168KB
-
memory/3500-132-0x0000000000000000-mapping.dmp