Resubmissions

05-12-2022 21:50

221205-1px8rsdf7x 10

05-12-2022 21:36

221205-1fxwmshg72 10

05-12-2022 21:13

221205-z2tknsbd2y 10

02-12-2022 18:49

221202-xgbs1sdc28 10

Analysis

  • max time kernel
    153s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 18:49

General

  • Target

    Claim.lnk

  • Size

    1KB

  • MD5

    9b3f9ba6670ca4f7462263afea03300d

  • SHA1

    05a28549badf8b9d83e5a9ea7c960d5a7e5e8a83

  • SHA256

    a4f4049b71130cd9104cbef4f6aeb3e9d6b10bcf53e154a5148a09e859cf0fa6

  • SHA512

    1d15aa99644718ba6bfda2e4bc56f7941ff229487601ef07ce0cf03cafbf1f5e80ecb851daa9729a608070d21a82a669d83296ea1a92624f55abef60d99379fa

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama225

Campaign

1669974461

C2

85.59.61.52:2222

66.191.69.18:995

186.64.67.9:443

174.104.184.149:443

91.165.188.74:50000

213.22.188.57:2222

173.18.126.3:443

90.89.95.158:2222

172.90.139.138:2222

78.100.230.10:995

184.153.132.82:443

41.100.146.58:443

85.152.152.46:443

75.99.125.235:2222

83.92.85.93:443

173.239.94.212:443

24.64.114.59:2222

74.66.134.24:443

98.145.23.67:443

213.67.255.57:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Claim.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c amended\concavity.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K amended\depressurize.cmd system rundl
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\SysWOW64\replace.exe
          replace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A
          4⤵
            PID:4604
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 amended\\unwarmed.tmp,DrawThemeIcon
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:4100
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5036

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1672-132-0x0000000000000000-mapping.dmp
    • memory/2384-133-0x0000000000000000-mapping.dmp
    • memory/4100-135-0x0000000000000000-mapping.dmp
    • memory/4100-136-0x0000000001400000-0x0000000001429000-memory.dmp
      Filesize

      164KB

    • memory/4100-137-0x0000000001430000-0x000000000145A000-memory.dmp
      Filesize

      168KB

    • memory/4100-139-0x0000000001430000-0x000000000145A000-memory.dmp
      Filesize

      168KB

    • memory/4604-134-0x0000000000000000-mapping.dmp
    • memory/5036-138-0x0000000000000000-mapping.dmp
    • memory/5036-140-0x0000000000620000-0x000000000064A000-memory.dmp
      Filesize

      168KB

    • memory/5036-141-0x0000000000620000-0x000000000064A000-memory.dmp
      Filesize

      168KB