Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06-01-2023 02:24
General
-
Target
2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0.dll
-
Size
414KB
-
MD5
2b55988c0d236edd5ea1a631ccd37b76
-
SHA1
033a22c3bb2b0dd1677973e1ae6280e5466e771c
-
SHA256
2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0
-
SHA512
de2c34008ce298b43fd0327c0493b3c50fe3c4842f53c15b9cf8b4d895a0cdd3814b7f192910d24d798c3796af29b5283197b454ce2e0cad6dd9a4daa3c8f5ff
-
SSDEEP
6144:UUpGOKUXcSjtM0vsW2g2uJ8yBW8RCtswtoMfLYzY8EI4zADpxhKY:IODMSjtHX2VyWkUtoeLYk8EHMjh1
Malware Config
Extracted
qakbot
403.780
obama194
1656313665
70.46.220.114:443
32.221.224.140:995
67.209.195.198:443
186.90.153.162:2222
148.64.96.100:443
67.165.206.193:993
86.200.151.188:2222
80.11.74.81:2222
173.174.216.62:443
45.241.173.232:993
41.228.22.180:443
1.161.81.21:995
24.178.196.158:2222
37.34.253.233:443
93.48.80.198:995
129.208.158.180:995
120.150.218.241:995
38.70.253.226:2222
111.125.245.116:995
47.23.89.60:993
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2d68755335776e3de28fcd1757b7dcc07688b31c37205ce2324d92c2f419c6f0.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 03:27 /tn wzbfztm /ET 03:38 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMgBkADYAOAA3ADUANQAzADMANQA3ADcANgBlADMAZABlADIAOABmAGMAZAAxADcANQA3AGIANwBkAGMAYwAwADcANgA4ADgAYgAzADEAYwAzADcAMgAwADUAYwBlADIAMwAyADQAZAA5ADIAYwAyAGYANAAxADkAYwA2AGYAMAAuAGQAbABsACIA" /SC ONCE4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
512KB
-
Filesize
136KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
136KB
-