Resubmissions

09-12-2022 21:31

221209-1djk8shc4x 10

02-12-2022 16:25

221202-txan4she2y 10

Analysis

  • max time kernel
    300s
  • max time network
    180s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-12-2022 16:25

General

  • Target

    12099 Dec 01.lnk

  • Size

    953B

  • MD5

    b71c5c29e3aa07a3051464f4ca39c72c

  • SHA1

    b37b40da060932ab2986ccb1546bf2d3c4890cf3

  • SHA256

    e8eea57788633710619a24bd72f7f99fbdfbb5efb46dbb21d746235f453f0ea5

  • SHA512

    6e806c26caa1868ca8a8214984bf67fdacfda078ca3a153cd09a9e30f980ef5e46aad797e009d2202d9a4b08661cb999f6b489c8e5e5b2650997e40600693f7c

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\12099 Dec 01.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rundll32.exe 161.dll,DrawThemeIcon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\system32\rundll32.exe
        rundll32.exe 161.dll,DrawThemeIcon
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe 161.dll,DrawThemeIcon
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4260

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1788-116-0x0000000000000000-mapping.dmp
  • memory/4260-226-0x0000000003020000-0x000000000304A000-memory.dmp
    Filesize

    168KB

  • memory/4260-232-0x0000000003020000-0x000000000304A000-memory.dmp
    Filesize

    168KB

  • memory/4260-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-185-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-173-0x0000000000000000-mapping.dmp
  • memory/4260-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-184-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-183-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-180-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4260-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4756-117-0x0000000000000000-mapping.dmp
  • memory/4760-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-167-0x0000000000890000-0x00000000008BD000-memory.dmp
    Filesize

    180KB

  • memory/4760-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-123-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-168-0x00000000008C0000-0x00000000008EA000-memory.dmp
    Filesize

    168KB

  • memory/4760-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-215-0x00000000008C0000-0x00000000008EA000-memory.dmp
    Filesize

    168KB

  • memory/4760-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp
    Filesize

    1MB

  • memory/4760-118-0x0000000000000000-mapping.dmp