Resubmissions

06-12-2022 06:15

221206-gzxv7sbc77 3

02-12-2022 17:00

221202-vjcrzsbc51 10

Analysis

  • max time kernel
    179s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 17:00

General

  • Target

    Claim.lnk

  • Size

    1KB

  • MD5

    2f8f51992462ce218dfee554c976510e

  • SHA1

    c92a3e2337bdd16f211299d0ae6b2336f9270a96

  • SHA256

    e2f568bba1216700f7ac0a6ee76c742298485a90bdc80a2002798ba304e68b3a

  • SHA512

    3a175e08f0bc6601952cb582e95ecadb0e89d57c5e7d59e27d5f7919056d13d087c424d9f3a32de6a974fd910536f0c9005ef8596fb07b5f4490daabb8f3e072

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama225

Campaign

1669974461

C2

85.59.61.52:2222

66.191.69.18:995

186.64.67.9:443

174.104.184.149:443

91.165.188.74:50000

213.22.188.57:2222

173.18.126.3:443

90.89.95.158:2222

172.90.139.138:2222

78.100.230.10:995

184.153.132.82:443

41.100.146.58:443

85.152.152.46:443

75.99.125.235:2222

83.92.85.93:443

173.239.94.212:443

24.64.114.59:2222

74.66.134.24:443

98.145.23.67:443

213.67.255.57:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 17 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Claim.lnk
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c respondents\ibidem.cmd
      Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K respondents\suspect.cmd system rundl
        Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Windows\SysWOW64\replace.exe
          replace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A
          PID:384
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 respondents\\crossbar.tmp,DrawThemeIcon
          Suspicious behavior: EnumeratesProcesses
          Suspicious behavior: MapViewOfSection
          Suspicious use of WriteProcessMemory
          PID:448
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            Suspicious behavior: EnumeratesProcesses
            PID:4920

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/384-134-0x0000000000000000-mapping.dmp
                        • memory/448-135-0x0000000000000000-mapping.dmp
                        • memory/448-136-0x0000000000AC0000-0x0000000000AE9000-memory.dmp
                        • memory/448-137-0x0000000000AF0000-0x0000000000B1A000-memory.dmp
                        • memory/448-139-0x0000000000AF0000-0x0000000000B1A000-memory.dmp
                        • memory/4500-132-0x0000000000000000-mapping.dmp
                        • memory/4788-133-0x0000000000000000-mapping.dmp
                        • memory/4920-138-0x0000000000000000-mapping.dmp
                        • memory/4920-140-0x00000000003A0000-0x00000000003CA000-memory.dmp
                        • memory/4920-141-0x00000000003A0000-0x00000000003CA000-memory.dmp