Analysis

  • max time kernel
    152s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 15:09

General

  • Target

    HG.lnk

  • Size

    1KB

  • MD5

    fbb437f912ab97ae5f0fdc6cc76c8fef

  • SHA1

    a179f76893355a8ff05bc7f3576fa1f5b9194982

  • SHA256

    36a24720c23d86511b2855440082c28f695e12f55327efef3e97142cfe80a54c

  • SHA512

    984f7abbde02ce5d491e8abb20dbb06ecbb8583437e3e5c2f5cc91798d8c8bb8d51a5f4f52edcfe7c11e74997cb51efc296b0f634f5f65589c5278a47cc323da

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB09

Campaign

1670238005

C2

76.100.159.250:443

66.191.69.18:995

186.64.67.9:443

50.90.249.161:443

109.150.179.158:2222

92.149.205.238:2222

86.165.15.180:2222

41.44.19.36:995

78.17.157.5:443

173.18.126.3:443

75.99.125.235:2222

172.90.139.138:2222

27.99.45.237:2222

91.68.227.219:443

12.172.173.82:993

103.144.201.62:2078

12.172.173.82:990

173.239.94.212:443

91.169.12.198:32100

24.64.114.59:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\HG.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c discoveries\pests.cmd
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K discoveries\dispersers.cmd system rundl
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\replace.exe
          replace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A
          4⤵
            PID:1264
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 discoveries\\erect.tmp,DrawThemeIcon
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1680
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1128

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1128-98-0x0000000000000000-mapping.dmp
    • memory/1128-101-0x0000000000080000-0x00000000000AA000-memory.dmp
      Filesize

      168KB

    • memory/1128-102-0x0000000000080000-0x00000000000AA000-memory.dmp
      Filesize

      168KB

    • memory/1264-93-0x0000000000000000-mapping.dmp
    • memory/1644-91-0x0000000000000000-mapping.dmp
    • memory/1680-94-0x0000000000000000-mapping.dmp
    • memory/1680-95-0x0000000075931000-0x0000000075933000-memory.dmp
      Filesize

      8KB

    • memory/1680-96-0x0000000000540000-0x00000000005B3000-memory.dmp
      Filesize

      460KB

    • memory/1680-97-0x0000000000250000-0x000000000027A000-memory.dmp
      Filesize

      168KB

    • memory/1680-100-0x0000000000250000-0x000000000027A000-memory.dmp
      Filesize

      168KB

    • memory/1732-88-0x0000000000000000-mapping.dmp
    • memory/1760-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp
      Filesize

      8KB