Analysis

  • max time kernel
    164s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 16:23

General

  • Target

    AS.js

  • Size

    136B

  • MD5

    a0fce6a73985e5e383037250a52684bc

  • SHA1

    94b19b04e4a1d878a92a366601750a38a11b88b8

  • SHA256

    3a11f938f6e4b11f19f4c2242245bcc28ebb0cab197520e0e91f137c9dab71d3

  • SHA512

    861e3919da7db8f1b9f5a5889ee819e05db0d3c79c41cda874fbb8eb3e69de76bf43e5242526e6417113b91f99afc96e5cdfec48e2147b1d468ed34a1d6ce1a7

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB08

Campaign

1669628564

C2

98.147.155.235:443

85.52.73.34:2222

75.158.15.211:443

2.91.184.252:995

92.106.70.62:2222

85.152.152.46:443

86.159.48.25:2222

217.128.91.196:2222

92.11.189.236:2222

83.92.85.93:443

2.83.62.105:443

93.24.192.142:20

76.20.42.45:443

24.64.114.59:2078

73.36.196.11:443

130.43.99.103:995

172.117.139.142:995

100.16.107.117:443

12.172.173.82:22

176.151.15.101:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\pretensions.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:204
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\users\public\rarePollinating.jpg DrawThemeIcon
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\users\public\rarePollinating.jpg DrawThemeIcon
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3720

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\rarePollinating.jpg

    Filesize

    472KB

    MD5

    4d3ca6ea1b0f9010a53a870f475c40ab

    SHA1

    59f1755050abcec7f5a3e4a217aeaaa7487ce32b

    SHA256

    2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

    SHA512

    62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

  • C:\users\public\rarePollinating.jpg

    Filesize

    472KB

    MD5

    4d3ca6ea1b0f9010a53a870f475c40ab

    SHA1

    59f1755050abcec7f5a3e4a217aeaaa7487ce32b

    SHA256

    2bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a

    SHA512

    62a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a

  • memory/204-139-0x00007FFA1A930000-0x00007FFA1B3F1000-memory.dmp

    Filesize

    10.8MB

  • memory/204-133-0x0000018D985C0000-0x0000018D985E2000-memory.dmp

    Filesize

    136KB

  • memory/204-134-0x00007FFA1A930000-0x00007FFA1B3F1000-memory.dmp

    Filesize

    10.8MB

  • memory/204-135-0x00007FFA1A930000-0x00007FFA1B3F1000-memory.dmp

    Filesize

    10.8MB

  • memory/204-132-0x0000000000000000-mapping.dmp

  • memory/1508-138-0x0000000000000000-mapping.dmp

  • memory/1508-141-0x0000000002DB0000-0x0000000002DDA000-memory.dmp

    Filesize

    168KB

  • memory/1508-142-0x0000000002DE0000-0x0000000002E0A000-memory.dmp

    Filesize

    168KB

  • memory/1508-145-0x0000000002DE0000-0x0000000002E0A000-memory.dmp

    Filesize

    168KB

  • memory/3128-136-0x0000000000000000-mapping.dmp

  • memory/3720-143-0x0000000000000000-mapping.dmp

  • memory/3720-144-0x00000000012D0000-0x00000000012FA000-memory.dmp

    Filesize

    168KB

  • memory/3720-146-0x00000000012D0000-0x00000000012FA000-memory.dmp

    Filesize

    168KB