Overview

overview

10

Static

static

1/control.exe

windows7-x64

1/control.exe

windows10-2004-x64

10

1/edputil.dll

windows7-x64

10

1/edputil.dll

windows10-2004-x64

10

1/msoffice32.dll

windows7-x64

10

1/msoffice32.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    166s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2022 19:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1/control.exe

  • Size

    146KB

  • MD5

    ebc29aa32c57a54018089cfc9cacafe8

  • SHA1

    0ac68652f6b5022d9e6d1edda5995efb253b984b

  • SHA256

    9799c9bf478bde688a8dd2096290d03af2ba059d718c2e5e36e500a005902bdc

  • SHA512

    af2cd9f3db78bd843ff3953ec0b6f2c519a6636d4ee78f74fbf5225dfe2b4e7c533613cc4d7cef154da40d326e5fb0969e298ab110b34e63aefecea3f1d8a1ac

  • SSDEEP

    3072:7yjxDJHjUfMeC2l7tq7Sp5+1k12b/Af885RK:+t9HLQ747+5+1kf15

Score
10/10
qakbotobama2211667915095bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

obama221

Campaign

1667915095

C2

199.83.165.233:443

24.142.218.202:443

79.166.120.168:995

92.24.200.226:995

151.32.168.124:443

72.88.245.71:443

46.229.194.17:443

142.119.40.220:2222

177.205.114.49:2222

174.104.184.149:443

86.167.26.227:2222

94.15.58.251:443

82.155.111.187:443

2.84.98.228:2222

69.133.162.35:443

92.189.214.236:2222

190.74.23.139:443

47.34.30.133:443

80.103.77.44:2222

82.34.170.37:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\control.exe
    "C:\Users\Admin\AppData\Local\Temp\1\control.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe msoffice32.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3732
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4888
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:3628

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1684-132-0x0000000000000000-mapping.dmp
      Download
    • memory/1684-133-0x0000000002730000-0x000000000275E000-memory.dmp
      Filesize

      184KB

      Download
    • memory/1684-134-0x0000000002760000-0x000000000278A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/1684-136-0x0000000002760000-0x000000000278A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/3732-135-0x0000000000000000-mapping.dmp
      Download
    • memory/3732-137-0x0000000000800000-0x000000000082A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/3732-138-0x0000000000800000-0x000000000082A000-memory.dmp
      Filesize

      168KB

      Download