Resubmissions

22-11-2022 12:57

221122-p7drasdc94 10

22-11-2022 12:52

221122-p4kqfagf9t 10

Analysis

  • max time kernel
    150s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2022 12:52

General

  • Target

    derelicts.dll

  • Size

    621KB

  • MD5

    869298ad11789b37cdd6842a2943055d

  • SHA1

    fa9ac0189c2717900ae0edac658dfa203f0f813b

  • SHA256

    7fbdcc7c0be32510a62b231fa8b1f12298b5380e0f72b756e37827fb63803bcc

  • SHA512

    9484072ab1b1f2f6f67073691d45606f270c86883d17021435ccadf7c925ee0ac0ccb4f43074cbf82a1064305031d133827df1053ae9b7c9ba1a109fa04ffe1a

  • SSDEEP

    12288:+Wd5j2OjX3bnp68L92ckM2MLt0tcETKvnp1Rau4Vvqs9sjW:+W5jHracV2xTOpkVvxo

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

C2

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\derelicts.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\derelicts.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/536-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

    Filesize

    8KB

  • memory/748-55-0x0000000000000000-mapping.dmp

  • memory/748-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

    Filesize

    8KB

  • memory/748-57-0x0000000000390000-0x00000000003BA000-memory.dmp

    Filesize

    168KB

  • memory/748-58-0x0000000000390000-0x00000000003BA000-memory.dmp

    Filesize

    168KB

  • memory/748-59-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/748-60-0x0000000000390000-0x00000000003BA000-memory.dmp

    Filesize

    168KB

  • memory/748-63-0x0000000000390000-0x00000000003BA000-memory.dmp

    Filesize

    168KB

  • memory/1780-61-0x0000000000000000-mapping.dmp

  • memory/1780-64-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB

  • memory/1780-65-0x0000000000080000-0x00000000000AA000-memory.dmp

    Filesize

    168KB