Resubmissions

20-12-2022 12:09

221220-pbrnaahd79 10

31-10-2022 07:39

221031-jg24baadb3 10

Analysis

  • max time kernel
    90s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2022 12:09

General

  • Target

    mal.dll

  • Size

    628KB

  • MD5

    0b027723b5af33dad8219cbdcd44ad9a

  • SHA1

    b2243901845b163db104ec790b983222f0691a94

  • SHA256

    cb5b8365be065ab9870b15a524decf7474575b0b14e796ee77d6f482dfb6d53c

  • SHA512

    82bdeb901957d45f9d72705863a3599fdbc57fc0ce2f3c5cd191e47ab754bd899715d290c189a512d0fcb804c6ec3cfe9cef3cb496a45e4eff54b74d1a29692e

  • SSDEEP

    12288:8x8IFmbH8yS5XXUrIVcxxn/5IOT2LY/O9bBoY//w:R6y8bRZARhI/LoO9bBoY/4

Malware Config

Extracted

Family

qakbot

Version

404.2

Botnet

obama218

Campaign

1666870886

C2

24.206.27.39:443

102.156.146.34:995

152.170.17.136:443

118.174.207.81:995

149.126.159.224:443

64.207.237.118:443

144.202.15.58:443

172.117.139.142:995

181.118.183.124:443

200.233.108.153:995

109.136.174.200:995

188.49.56.189:443

190.74.248.136:443

45.48.36.226:2087

45.35.97.45:443

193.3.19.137:443

14.161.84.145:443

27.110.134.202:995

156.220.47.67:993

142.115.84.88:2222

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\mal.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\mal.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 732
        3⤵
        • Program crash
        PID:4992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3756 -ip 3756
    1⤵
      PID:2200

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3756-133-0x00000000033F0000-0x0000000003419000-memory.dmp

      Filesize

      164KB

    • memory/3756-134-0x0000000003390000-0x00000000033BA000-memory.dmp

      Filesize

      168KB

    • memory/3756-135-0x00000000033F0000-0x0000000003419000-memory.dmp

      Filesize

      164KB