Analysis

  • max time kernel
    600s
  • max time network
    598s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2023, 02:48

General

  • Target

    RunDLL-1.bat

  • Size

    28B

  • MD5

    707a85392304853a2f2c42e1e39cafd4

  • SHA1

    d5d67d2dbcfa5f4061ca32da36cfbee9f3c2a213

  • SHA256

    06b1fc756f405efb9f1ef0446bfe9366315ed9e25cfeb98750475e7ed4266161

  • SHA512

    3cedae886b9a658f0c566226c5633358d8571fc494a95c968d9df08c40183e206eaeae12860e1c56bcaebde236af4a9b885b7b2760edc38ae34780cc463d7416

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

BB12

Campaign

1675352134

C2

213.67.255.57:2222

86.96.72.139:2222

119.82.122.226:443

86.96.34.182:2222

12.172.173.82:50001

107.146.12.26:2222

97.116.78.96:443

47.61.70.188:2078

197.148.17.17:2078

82.127.204.82:2222

82.121.195.187:2222

73.155.10.79:443

91.231.173.199:995

86.196.12.21:2222

90.78.51.182:2222

90.165.109.4:2222

202.186.177.88:443

92.27.86.48:2222

88.171.156.150:50000

78.130.215.67:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\RunDLL-1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\system32\rundll32.exe
      rundll32.exe index1.png,Wind
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe index1.png,Wind
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\SysWOW64\wermgr.exe
          C:\Windows\SysWOW64\wermgr.exe
          4⤵
            PID:516
          • C:\Windows\SysWOW64\wermgr.exe
            C:\Windows\SysWOW64\wermgr.exe
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:556

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\2F2D8E20.dll

      Filesize

      268KB

      MD5

      53bb811ed12d2c867b354390fabf9612

      SHA1

      81b29c540c0e2a09385cf7e821639ff64fbffd91

      SHA256

      a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

      SHA512

      5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

    • \Users\Admin\AppData\Local\Temp\A54D33C6.dll

      Filesize

      268KB

      MD5

      53bb811ed12d2c867b354390fabf9612

      SHA1

      81b29c540c0e2a09385cf7e821639ff64fbffd91

      SHA256

      a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

      SHA512

      5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

    • memory/556-66-0x0000000000080000-0x00000000000A3000-memory.dmp

      Filesize

      140KB

    • memory/556-67-0x0000000000080000-0x00000000000A3000-memory.dmp

      Filesize

      140KB

    • memory/948-56-0x0000000075551000-0x0000000075553000-memory.dmp

      Filesize

      8KB

    • memory/948-57-0x0000000000250000-0x0000000000273000-memory.dmp

      Filesize

      140KB