Analysis

  • max time kernel
    150s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2023, 12:54

General

  • Target

    myufn.dll

  • Size

    812KB

  • MD5

    ab774bc383c2873262b3d0e7053dc464

  • SHA1

    887c14c6ea122c04bc821a727fc3c439c7b1846d

  • SHA256

    c5701af10df111f738ed461f5b071c4165ad6e26446a21daea8accb769b55f26

  • SHA512

    f5be764506ef200507e42e78bb866f3365db256fddd00bc1dcca24f663b391309561a423d8f394da6388248f952cc0fb64907f802d81040e53e4bda8d1801d8e

  • SSDEEP

    24576:sikjPg+4QceLhb6fMYaq4RPaOFmyjAjX:Bk0YBq6fjqX

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

BB12

Campaign

1675161160

C2

114.143.176.234:443

88.126.94.4:50000

103.252.7.228:443

87.10.205.117:443

82.15.58.109:2222

72.80.7.6:995

90.162.45.154:2222

47.34.30.133:443

50.68.204.71:993

112.141.184.246:995

73.165.119.20:443

91.169.12.198:32100

173.18.126.3:443

87.56.238.53:443

85.241.180.94:443

12.172.173.82:50001

92.154.17.149:2222

103.42.86.246:995

12.172.173.82:990

91.254.132.23:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\myufn.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\myufn.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
          PID:1704
        • C:\Windows\SysWOW64\wermgr.exe
          C:\Windows\SysWOW64\wermgr.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1692

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\23925755.dll

      Filesize

      268KB

      MD5

      53bb811ed12d2c867b354390fabf9612

      SHA1

      81b29c540c0e2a09385cf7e821639ff64fbffd91

      SHA256

      a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

      SHA512

      5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

    • \Users\Admin\AppData\Local\Temp\EE944C6B.dll

      Filesize

      268KB

      MD5

      53bb811ed12d2c867b354390fabf9612

      SHA1

      81b29c540c0e2a09385cf7e821639ff64fbffd91

      SHA256

      a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

      SHA512

      5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

    • memory/1576-57-0x00000000002F0000-0x0000000000313000-memory.dmp

      Filesize

      140KB

    • memory/1576-59-0x00000000002F0000-0x0000000000313000-memory.dmp

      Filesize

      140KB

    • memory/1576-58-0x00000000002F0000-0x0000000000313000-memory.dmp

      Filesize

      140KB

    • memory/1576-60-0x00000000002B0000-0x00000000002E2000-memory.dmp

      Filesize

      200KB

    • memory/1576-61-0x00000000002F0000-0x0000000000313000-memory.dmp

      Filesize

      140KB

    • memory/1576-56-0x00000000007C0000-0x000000000088A000-memory.dmp

      Filesize

      808KB

    • memory/1576-55-0x0000000075111000-0x0000000075113000-memory.dmp

      Filesize

      8KB

    • memory/1576-66-0x00000000002F0000-0x0000000000313000-memory.dmp

      Filesize

      140KB

    • memory/1692-67-0x00000000000D0000-0x00000000000F3000-memory.dmp

      Filesize

      140KB

    • memory/1692-68-0x00000000000D0000-0x00000000000F3000-memory.dmp

      Filesize

      140KB