Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/01/2023, 05:36
General
- Target WP.vbs
- Size 186B
- Sample230109-gawxlsdb35
- SHA256 ecd701720d825629eb26aa23f2390f629639250fc888dcf0b6e4b6a4c53fb81d
Malware Config
Extracted
-
qakbot
-
404.46
-
obama224
-
1669794048
-
75.161.233.194:995
-
216.82.134.218:443
-
174.104.184.149:443
-
173.18.126.3:443
-
87.202.101.164:50000
-
172.90.139.138:2222
-
184.153.132.82:443
-
185.135.120.81:443
-
24.228.132.224:2222
-
87.223.84.190:443
-
178.153.195.40:443
-
24.64.114.59:2222
-
77.126.81.208:443
-
75.99.125.235:2222
-
173.239.94.212:443
-
98.145.23.67:443
-
109.177.245.176:2222
-
72.200.109.104:443
-
12.172.173.82:993
-
82.11.242.219:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WP.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass metaphysic\\possessively.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\users\public\mercifulHaddock.txt DrawThemeIcon3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mercifulHaddock.txt
mercifulHaddock.txt
memory/2360-151-0x0000000000160000-0x000000000018A000-memory.dmp
memory/2360-150-0x0000000000160000-0x000000000018A000-memory.dmp
memory/4468-142-0x0000000007BC0000-0x0000000008164000-memory.dmp
memory/4468-137-0x0000000005590000-0x00000000055F6000-memory.dmp
memory/4468-139-0x0000000007570000-0x0000000007606000-memory.dmp
memory/4468-140-0x0000000006800000-0x000000000681A000-memory.dmp
memory/4468-141-0x00000000068A0000-0x00000000068C2000-memory.dmp
memory/4468-133-0x00000000029C0000-0x00000000029F6000-memory.dmp
memory/4468-138-0x00000000062E0000-0x00000000062FE000-memory.dmp
memory/4468-136-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4468-134-0x0000000005610000-0x0000000005C38000-memory.dmp
memory/4468-135-0x0000000005410000-0x0000000005432000-memory.dmp
memory/5088-147-0x0000000000D50000-0x0000000000D7A000-memory.dmp
memory/5088-149-0x0000000000D50000-0x0000000000D7A000-memory.dmp
memory/5088-146-0x0000000000D20000-0x0000000000D4D000-memory.dmp