Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/11/2022, 06:07
General
- Target AS.js
- Size 138B
- Sample221129-gva6mscd35
- SHA256 a1abe2c6dbccaaa6a04fbbc903043d2e2bb14e1534204ccbaf6b059ee754a2b0
Malware Config
Extracted
-
qakbot
-
404.46
-
BB08
-
1669628564
-
98.147.155.235:443
-
85.52.73.34:2222
-
75.158.15.211:443
-
2.91.184.252:995
-
92.106.70.62:2222
-
85.152.152.46:443
-
86.159.48.25:2222
-
217.128.91.196:2222
-
92.11.189.236:2222
-
83.92.85.93:443
-
2.83.62.105:443
-
93.24.192.142:20
-
76.20.42.45:443
-
24.64.114.59:2078
-
73.36.196.11:443
-
130.43.99.103:995
-
172.117.139.142:995
-
100.16.107.117:443
-
12.172.173.82:22
-
176.151.15.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\unwatermarked.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\agreeBrood.jpg DrawThemeIcon3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\agreeBrood.jpg DrawThemeIcon4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
agreeBrood.jpg
agreeBrood.jpg
memory/3048-140-0x00000000003A0000-0x00000000003CA000-memory.dmp
memory/3048-141-0x0000000001FA0000-0x0000000001FCA000-memory.dmp
memory/3048-143-0x0000000001FA0000-0x0000000001FCA000-memory.dmp
memory/4248-144-0x0000000000730000-0x000000000075A000-memory.dmp
memory/4248-145-0x0000000000730000-0x000000000075A000-memory.dmp
memory/5036-134-0x00007FF997050000-0x00007FF997B11000-memory.dmp
memory/5036-137-0x00007FF997050000-0x00007FF997B11000-memory.dmp
memory/5036-133-0x0000029DBCAD0000-0x0000029DBCAF2000-memory.dmp