Analysis
-
max time kernel
177s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
21-11-2022 16:30
General
-
Target
almond/wispy.dll
-
Size
490KB
-
MD5
df888c8db7c11bcc0e7b45723669689f
-
SHA1
5f0170f2af8dddc456ddf8f8f05cf27dd59604d1
-
SHA256
df395187c0289ae3576bca0042ceb3b909cee84dfd1b156662a11fb18cde02fa
-
SHA512
4a8c7921e722d7b9084c77fd8d33b458335c9d677d1df4058e5f6d13552a0f95f55d413410dcbd9d5f83028f32c897771750410c55a7e4cd46722ef611a1d8c5
-
SSDEEP
6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TIYMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTmiwz4agFwid7e
Malware Config
Extracted
qakbot
404.30
BB07
1669024152
69.119.123.159:2222
197.148.17.17:2078
174.104.184.149:443
12.172.173.82:995
91.68.227.219:443
85.241.180.94:443
83.7.53.150:443
213.22.188.57:2222
71.46.234.170:443
190.75.150.58:2222
86.98.15.100:995
89.115.196.99:443
83.31.254.67:2222
46.162.109.183:443
2.84.98.228:2222
78.69.251.252:2222
12.172.173.82:465
75.143.236.149:443
47.229.96.60:443
80.121.8.212:995
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\wispy.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\almond\wispy.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
172KB
-
Filesize
168KB
-
Filesize
168KB
-
-
Filesize
168KB
-
Filesize
168KB