Analysis
- max time kernel
601s - max time network
603s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/12/2022, 21:32
General
- Target WP.vbs
- Size 181B
- Sample221209-1dzx8aed66
- SHA256 6176a28d3c16b51c41d9b81b625423fe0d3c0addc6a8e32613ca7e10d540d990
Malware Config
Extracted
-
qakbot
-
404.46
-
obama224
-
1669794048
-
75.161.233.194:995
-
216.82.134.218:443
-
174.104.184.149:443
-
173.18.126.3:443
-
87.202.101.164:50000
-
172.90.139.138:2222
-
184.153.132.82:443
-
185.135.120.81:443
-
24.228.132.224:2222
-
87.223.84.190:443
-
178.153.195.40:443
-
24.64.114.59:2222
-
77.126.81.208:443
-
75.99.125.235:2222
-
173.239.94.212:443
-
98.145.23.67:443
-
109.177.245.176:2222
-
72.200.109.104:443
-
12.172.173.82:993
-
82.11.242.219:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WP.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass metaphysic\\leveler.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\dotageWithdrew.txt DrawThemeIcon3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
dotageWithdrew.txt
dotageWithdrew.txt
memory/2388-142-0x0000000007450000-0x00000000079F4000-memory.dmp
memory/2388-141-0x00000000061B0000-0x00000000061D2000-memory.dmp
memory/2388-136-0x0000000005430000-0x0000000005496000-memory.dmp
memory/2388-137-0x0000000005510000-0x0000000005576000-memory.dmp
memory/2388-138-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/2388-139-0x0000000006E00000-0x0000000006E96000-memory.dmp
memory/2388-140-0x0000000006160000-0x000000000617A000-memory.dmp
memory/2388-133-0x00000000022C0000-0x00000000022F6000-memory.dmp
memory/2388-135-0x0000000004CF0000-0x0000000004D12000-memory.dmp
memory/2388-134-0x0000000004E00000-0x0000000005428000-memory.dmp
memory/3828-151-0x00000000008A0000-0x00000000008CA000-memory.dmp
memory/3828-150-0x00000000008A0000-0x00000000008CA000-memory.dmp
memory/4440-149-0x0000000000AB0000-0x0000000000ADA000-memory.dmp
memory/4440-147-0x0000000000AB0000-0x0000000000ADA000-memory.dmp
memory/4440-146-0x0000000000A80000-0x0000000000AAD000-memory.dmp