Analysis

  • max time kernel
    151s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2022 13:43

General

  • Target

    AS.js

  • Size

    9KB

  • MD5

    b6377f4364852191e440269dc0225850

  • SHA1

    4784a7c288fbffaea4e5c10cfc2da208578977a2

  • SHA256

    d0f396309db14bbe988e8ae6ba6dfb4451fc9db830484dcb7dec830b74d8467a

  • SHA512

    302ab00ac77e86b3448bcf7affeb5e127e606d977556af0da17d211b816bc00b2d54643ceacf219f2c4be6532781e1d64db31d4a307ae822f9b70dc1617da7db

  • SSDEEP

    192:CSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5A0:N5Kk785UIhp/KTMhSeYmn2jiu5EjP+rV

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass peseta\gratiae.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\users\public\test1.txt DrawThemeIcon
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\users\public\test1.txt DrawThemeIcon
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\users\public\test1.txt
    Filesize

    472KB

    MD5

    e9418a32d9191339800b07e816d1374a

    SHA1

    8930a6157e30f7d277d94ef2c3797c30d2147822

    SHA256

    9546ad96dd59612da1ea20637613ad0c1154e599b3c5a37b5404f4301cf78348

    SHA512

    388a02cabafbb89a54879c09d4abe7f3bc9f9b676a1cb107e9a152e49513aaea0af95ec9ae26c44fb5fb8822af1f1b4c4a37888f9313f29991a15ef01ec68a04

  • \Users\Public\test1.txt
    Filesize

    472KB

    MD5

    e9418a32d9191339800b07e816d1374a

    SHA1

    8930a6157e30f7d277d94ef2c3797c30d2147822

    SHA256

    9546ad96dd59612da1ea20637613ad0c1154e599b3c5a37b5404f4301cf78348

    SHA512

    388a02cabafbb89a54879c09d4abe7f3bc9f9b676a1cb107e9a152e49513aaea0af95ec9ae26c44fb5fb8822af1f1b4c4a37888f9313f29991a15ef01ec68a04

  • memory/1272-66-0x00000000024CB000-0x00000000024EA000-memory.dmp
    Filesize

    124KB

  • memory/1272-57-0x000007FEF3BC0000-0x000007FEF45E3000-memory.dmp
    Filesize

    10.1MB

  • memory/1272-58-0x000007FEF3060000-0x000007FEF3BBD000-memory.dmp
    Filesize

    11.4MB

  • memory/1272-60-0x00000000024CB000-0x00000000024EA000-memory.dmp
    Filesize

    124KB

  • memory/1272-61-0x00000000024C4000-0x00000000024C7000-memory.dmp
    Filesize

    12KB

  • memory/1272-62-0x00000000024CB000-0x00000000024EA000-memory.dmp
    Filesize

    124KB

  • memory/1272-59-0x00000000024C4000-0x00000000024C7000-memory.dmp
    Filesize

    12KB

  • memory/1272-65-0x00000000024C4000-0x00000000024C7000-memory.dmp
    Filesize

    12KB

  • memory/1272-55-0x0000000000000000-mapping.dmp
  • memory/1476-73-0x0000000000230000-0x000000000025A000-memory.dmp
    Filesize

    168KB

  • memory/1476-67-0x0000000000000000-mapping.dmp
  • memory/1476-68-0x00000000761F1000-0x00000000761F3000-memory.dmp
    Filesize

    8KB

  • memory/1476-70-0x0000000000230000-0x000000000025A000-memory.dmp
    Filesize

    168KB

  • memory/1476-71-0x0000000000230000-0x000000000025A000-memory.dmp
    Filesize

    168KB

  • memory/1476-72-0x00000000001C0000-0x00000000001EA000-memory.dmp
    Filesize

    168KB

  • memory/1476-76-0x0000000000230000-0x000000000025A000-memory.dmp
    Filesize

    168KB

  • memory/1632-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp
    Filesize

    8KB

  • memory/1728-74-0x0000000000000000-mapping.dmp
  • memory/1728-77-0x0000000000080000-0x00000000000AA000-memory.dmp
    Filesize

    168KB

  • memory/1728-78-0x0000000000080000-0x00000000000AA000-memory.dmp
    Filesize

    168KB

  • memory/1884-63-0x0000000000000000-mapping.dmp