Resubmissions

06-12-2022 06:15

221206-gzxv7sbc77 3

02-12-2022 17:00

221202-vjcrzsbc51 10

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2022 17:00

General

  • Target

    Claim.lnk

  • Size

    1KB

  • MD5

    2f8f51992462ce218dfee554c976510e

  • SHA1

    c92a3e2337bdd16f211299d0ae6b2336f9270a96

  • SHA256

    e2f568bba1216700f7ac0a6ee76c742298485a90bdc80a2002798ba304e68b3a

  • SHA512

    3a175e08f0bc6601952cb582e95ecadb0e89d57c5e7d59e27d5f7919056d13d087c424d9f3a32de6a974fd910536f0c9005ef8596fb07b5f4490daabb8f3e072

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama225

Campaign

1669974461

C2

85.59.61.52:2222

66.191.69.18:995

186.64.67.9:443

174.104.184.149:443

91.165.188.74:50000

213.22.188.57:2222

173.18.126.3:443

90.89.95.158:2222

172.90.139.138:2222

78.100.230.10:995

184.153.132.82:443

41.100.146.58:443

85.152.152.46:443

75.99.125.235:2222

83.92.85.93:443

173.239.94.212:443

24.64.114.59:2222

74.66.134.24:443

98.145.23.67:443

213.67.255.57:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Claim.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system rundl
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\SysWOW64\replace.exe
          replace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A
          4⤵
            PID:680
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 respondents\\crossbar.tmp,DrawThemeIcon
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:796

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/680-93-0x0000000000000000-mapping.dmp

    • memory/796-100-0x0000000000000000-mapping.dmp

    • memory/796-104-0x0000000000080000-0x00000000000AA000-memory.dmp

      Filesize

      168KB

    • memory/796-103-0x0000000000080000-0x00000000000AA000-memory.dmp

      Filesize

      168KB

    • memory/832-54-0x000007FEFC611000-0x000007FEFC613000-memory.dmp

      Filesize

      8KB

    • memory/1636-88-0x0000000000000000-mapping.dmp

    • memory/1760-92-0x0000000000000000-mapping.dmp

    • memory/1856-97-0x0000000000150000-0x000000000017A000-memory.dmp

      Filesize

      168KB

    • memory/1856-98-0x0000000000120000-0x0000000000149000-memory.dmp

      Filesize

      164KB

    • memory/1856-99-0x0000000000150000-0x000000000017A000-memory.dmp

      Filesize

      168KB

    • memory/1856-96-0x0000000000150000-0x000000000017A000-memory.dmp

      Filesize

      168KB

    • memory/1856-102-0x0000000000150000-0x000000000017A000-memory.dmp

      Filesize

      168KB

    • memory/1856-95-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

      Filesize

      8KB

    • memory/1856-94-0x0000000000000000-mapping.dmp