Resubmissions

05-12-2022 21:11

221205-z14z1sbc4z 10

05-12-2022 21:02

221205-zvg83aae9z 10

05-12-2022 20:55

221205-zqp34sab9t 10

Analysis

  • max time kernel
    150s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 20:55

General

  • Target

    Claim.lnk

  • Size

    1KB

  • MD5

    de308aec56de0b862231a6bb649a7f93

  • SHA1

    0c7a02535887510c5a79393cbe9de3ed8d98127b

  • SHA256

    1140a8cc4e36d99308587e748054342528744809cfea8eea9ccd945f874c662a

  • SHA512

    a6d96ea68afc028edd8ed06d6d77cc8c64727401bfcde78aff719a94e940eab7d8fdf1b336444a5db9f7e961bfda381aabb7cb34de9cd9d24a38bf6344a5daff

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama225

Campaign

1669974461

C2

85.59.61.52:2222

66.191.69.18:995

186.64.67.9:443

174.104.184.149:443

91.165.188.74:50000

213.22.188.57:2222

173.18.126.3:443

90.89.95.158:2222

172.90.139.138:2222

78.100.230.10:995

184.153.132.82:443

41.100.146.58:443

85.152.152.46:443

75.99.125.235:2222

83.92.85.93:443

173.239.94.212:443

24.64.114.59:2222

74.66.134.24:443

98.145.23.67:443

213.67.255.57:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Claim.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c undampened\risibly.cmd
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K undampened\reassembly.cmd system rundl
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:852
        • C:\Windows\SysWOW64\replace.exe
          replace C:\Windows\\system32\\rundlr32.exe C:\Users\Admin\AppData\Local\Temp /A
          4⤵
            PID:876
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 undampened\\purposeful.tmp,DrawThemeIcon
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1532

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/396-99-0x0000000000360000-0x000000000038A000-memory.dmp
      Filesize

      168KB

    • memory/396-96-0x0000000000360000-0x000000000038A000-memory.dmp
      Filesize

      168KB

    • memory/396-103-0x0000000000360000-0x000000000038A000-memory.dmp
      Filesize

      168KB

    • memory/396-98-0x0000000000180000-0x00000000001A9000-memory.dmp
      Filesize

      164KB

    • memory/396-94-0x0000000000000000-mapping.dmp
    • memory/396-95-0x00000000767F1000-0x00000000767F3000-memory.dmp
      Filesize

      8KB

    • memory/396-97-0x0000000000360000-0x000000000038A000-memory.dmp
      Filesize

      168KB

    • memory/852-92-0x0000000000000000-mapping.dmp
    • memory/876-93-0x0000000000000000-mapping.dmp
    • memory/920-88-0x0000000000000000-mapping.dmp
    • memory/1228-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp
      Filesize

      8KB

    • memory/1532-100-0x0000000000000000-mapping.dmp
    • memory/1532-102-0x0000000000080000-0x00000000000AA000-memory.dmp
      Filesize

      168KB

    • memory/1532-104-0x0000000000080000-0x00000000000AA000-memory.dmp
      Filesize

      168KB