Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
16-12-2022 15:58
General
-
Target
50673ab3d69a6a4cb476fe103672904d034ac00780f674a23c75cc4bd1736147.dll
-
Size
441KB
-
MD5
92a0a65edfa69e2764d30d46adb5e4e1
-
SHA1
4ecba4e691ff85136502aabbce41275a498a924e
-
SHA256
50673ab3d69a6a4cb476fe103672904d034ac00780f674a23c75cc4bd1736147
-
SHA512
899dd9f439ee5b35d703ffe748e2facf84505128a6148490a685213f8a987a981d380d7a2e4de188bb3e5aa7f420b1e47fde0dd1620193eb996c3815a529a68c
-
SSDEEP
6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH
Malware Config
Extracted
qakbot
403.862
BB
1663148750
193.3.19.37:443
99.232.140.205:2222
99.253.251.74:443
197.94.210.133:443
37.210.148.30:995
14.161.194.86:443
154.181.203.230:995
200.161.62.126:32101
134.35.10.122:443
64.207.215.69:443
81.131.161.131:2078
217.165.85.223:993
78.100.225.34:2222
85.114.110.108:443
102.38.96.108:995
123.240.131.1:443
109.158.159.179:993
186.105.182.127:443
190.44.40.48:995
88.233.194.154:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\50673ab3d69a6a4cb476fe103672904d034ac00780f674a23c75cc4bd1736147.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\50673ab3d69a6a4cb476fe103672904d034ac00780f674a23c75cc4bd1736147.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:01 /tn yofyvvrf /ET 17:12 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANQAwADYANwAzAGEAYgAzAGQANgA5AGEANgBhADQAYwBiADQANwA2AGYAZQAxADAAMwA2ADcAMgA5ADAANABkADAAMwA0AGEAYwAwADAANwA4ADAAZgA2ADcANABhADIAMwBjADcANQBjAGMANABiAGQAMQA3ADMANgAxADQANwAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
Filesize
136KB
-
Filesize
136KB
-
-
Filesize
136KB
-
Filesize
136KB