Overview

overview

10

Static

static

NewRules_EOM0.iso

windows7-x64

3

NewRules_EOM0.iso

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2022 19:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NewRules_EOM0.iso

  • Size

    1.0MB

  • MD5

    b2b2a3673e2cae92bc63484757a95eae

  • SHA1

    36df5bab5cf803d303c7f942e73f45807afb52b1

  • SHA256

    5ecf9f18ab957cb09c144d083e22ade66e2924cf5fa4423b06977ccb23d1bd40

  • SHA512

    4661fb5f3c97b5d64c1226b4774d4f61278ec161946d1d19fba5032aa5865ac35cf1b0dc38ea011ef577390246ef8fdfb7b81d71ee9324aca091164c6b888dfd

  • SSDEEP

    12288:D7uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC7K:D+sVmhledMmGdu+ZqHzC7K

Score
10/10
qakbotazd1672147664bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1672147664

C2

80.103.77.44:2222

136.35.241.159:443

73.88.173.113:443

186.64.67.12:443

76.80.180.154:995

83.248.199.56:443

125.20.112.94:443

72.80.7.6:995

50.68.204.71:443

90.79.129.166:2222

108.162.6.34:443

86.130.9.250:2222

41.228.225.131:995

86.134.75.5:443

190.249.241.149:443

70.115.104.126:995

84.113.121.103:443

198.2.51.242:993

172.90.139.138:2222

89.115.196.99:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\NewRules_EOM0.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1104
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3396
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c DirectContract\NewInvoice.cmd A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9
      1⤵
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\system32\rundll32.exe
        rundll32 /s needchangerules.bin,Updt
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 /s needchangerules.bin,Updt
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1776

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1420-133-0x0000000000000000-mapping.dmp
      Download
    • memory/1420-134-0x0000000000CE0000-0x0000000000D0A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/1776-139-0x0000000000000000-mapping.dmp
      Download
    • memory/1776-140-0x0000000000F10000-0x0000000000F3A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/1776-141-0x0000000000F10000-0x0000000000F3A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/2900-132-0x0000000000000000-mapping.dmp
      Download