Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29-11-2022 20:59
General
-
Target
AS.js
-
Size
131B
-
MD5
173bac7422b091276ff2c147cca1ff57
-
SHA1
cf25a618c0cc4f57b3139973741d1879d7303306
-
SHA256
8b75440ac99b2fe294376684d48a86382bf17dbb8f17da86a330fc5690411573
-
SHA512
ef7f977f8c3be4d77c8fdb216f9a98d41ffc14153d88dde8a3a926c7619f150ec4a9ca36029c7be75931aa14992aea31d9b56bdfea848814e571198cfd8625f3
Malware Config
Extracted
qakbot
404.46
BB08
1669628564
98.147.155.235:443
85.52.73.34:2222
75.158.15.211:443
2.91.184.252:995
92.106.70.62:2222
85.152.152.46:443
86.159.48.25:2222
217.128.91.196:2222
92.11.189.236:2222
83.92.85.93:443
2.83.62.105:443
93.24.192.142:20
76.20.42.45:443
24.64.114.59:2078
73.36.196.11:443
130.43.99.103:995
172.117.139.142:995
100.16.107.117:443
12.172.173.82:22
176.151.15.101:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\AS.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\mildew.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\quintuplicationDimples.jpg DrawThemeIcon3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\quintuplicationDimples.jpg DrawThemeIcon4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\users\public\quintuplicationDimples.jpgFilesize
472KB
MD54d3ca6ea1b0f9010a53a870f475c40ab
SHA159f1755050abcec7f5a3e4a217aeaaa7487ce32b
SHA2562bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a
SHA51262a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a
-
\Users\Public\quintuplicationDimples.jpgFilesize
472KB
MD54d3ca6ea1b0f9010a53a870f475c40ab
SHA159f1755050abcec7f5a3e4a217aeaaa7487ce32b
SHA2562bbe82d038bd24cc3e5e579f8a90e4229c6dff6a17fe0609caddfa045e18d36a
SHA51262a10a6f700e23167f9a34cde909b061d170d90aee159ba3f06de916290ccc7012060881ce68c7058878578a1ead5d14d1248a14800007eacc4e580648f1c19a
-
memory/1224-60-0x0000000001DCB000-0x0000000001DEA000-memory.dmpFilesize
124KB
-
memory/1224-58-0x000007FEF2650000-0x000007FEF31AD000-memory.dmpFilesize
11.4MB
-
memory/1224-59-0x0000000001DC4000-0x0000000001DC7000-memory.dmpFilesize
12KB
-
memory/1224-55-0x0000000000000000-mapping.dmp
-
memory/1224-61-0x0000000001DCB000-0x0000000001DEA000-memory.dmpFilesize
124KB
-
memory/1224-63-0x0000000001DC4000-0x0000000001DC7000-memory.dmpFilesize
12KB
-
memory/1224-64-0x0000000001DCB000-0x0000000001DEA000-memory.dmpFilesize
124KB
-
memory/1224-57-0x000007FEF31B0000-0x000007FEF3BD3000-memory.dmpFilesize
10.1MB
-
memory/1232-62-0x0000000000000000-mapping.dmp
-
memory/1480-66-0x0000000000000000-mapping.dmp
-
memory/1480-67-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1480-69-0x0000000000140000-0x000000000016A000-memory.dmpFilesize
168KB
-
memory/1480-70-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1480-72-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1480-73-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1480-76-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1672-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmpFilesize
8KB
-
memory/2024-74-0x0000000000000000-mapping.dmp
-
memory/2024-77-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/2024-78-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
