Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 20:51

General

  • Target

    06917 Dec 01.lnk

  • Size

    953B

  • MD5

    9ffcb1e433c7e487898866ad9b514dac

  • SHA1

    ecfef94f8895dbf4771a2e812a7b9da4fc4a96c1

  • SHA256

    3dd7a3b704f58ba8f2028e246d48868d9937a8bb550a310dbaa7b3a5d62a1e7b

  • SHA512

    f658eeb0a424dd44b61012050bfc36d9d039a8ef994fa7c0d308ea72bfc27b3f8ef4a4d01c24d415c14360d2f825afd2124dbf7757bec18cdd92c04801985b39

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\06917 Dec 01.lnk"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rundll32.exe 322.dll,DrawThemeIcon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\system32\rundll32.exe
        rundll32.exe 322.dll,DrawThemeIcon
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe 322.dll,DrawThemeIcon
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1564

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1336-133-0x0000000000000000-mapping.dmp
  • memory/1420-134-0x0000000000000000-mapping.dmp
  • memory/1420-135-0x0000000002670000-0x000000000269D000-memory.dmp
    Filesize

    180KB

  • memory/1420-136-0x00000000026A0000-0x00000000026CA000-memory.dmp
    Filesize

    168KB

  • memory/1420-138-0x00000000026A0000-0x00000000026CA000-memory.dmp
    Filesize

    168KB

  • memory/1564-137-0x0000000000000000-mapping.dmp
  • memory/1564-139-0x0000000000EA0000-0x0000000000ECA000-memory.dmp
    Filesize

    168KB

  • memory/1564-140-0x0000000000EA0000-0x0000000000ECA000-memory.dmp
    Filesize

    168KB

  • memory/4656-132-0x0000000000000000-mapping.dmp