Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/02/2023, 19:31

General

  • Target

    oslo/trudge.dll

  • Size

    1.6MB

  • MD5

    a4af6ab7189ea34967c0fe94d87306f0

  • SHA1

    d3598e025f311c716efb5be6b60a85704eaccd19

  • SHA256

    476760304bb6b6192579b108ab2c885f53628818e26b90977404d628f5871722

  • SHA512

    9abb8e4296e0b3bb664066b5f016d709badb29407e065290915e986cc2adf87d04e6ba9636d6a4f28acbca8f057661b0839aa5de8bc95181cdac6290ad21650d

  • SSDEEP

    24576:12gUXd2F9pZ6gGxxuFZ9HpuKt5VIWZypPsHycDizFitRCFvgx1WZXJM5T//82:12gOYNWuFZ9JAEHNWFOWvgD+5M

Malware Config

Extracted

Family

qakbot

Version

403.973

Botnet

obama213

Campaign

1665998932

C2

70.173.248.13:443

219.71.108.177:443

206.1.189.186:443

14.246.151.175:443

102.159.77.134:995

200.233.108.153:993

134.35.3.85:443

190.199.186.117:2222

200.155.61.245:995

103.156.237.71:443

176.44.119.153:443

181.56.171.3:995

151.251.50.117:443

163.182.177.80:443

104.202.220.123:443

41.101.92.195:443

190.193.180.228:443

190.204.112.207:2222

41.97.56.102:443

41.69.209.76:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\oslo\trudge.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\oslo\trudge.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 712
        3⤵
        • Program crash
        PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4492-117-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-118-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-119-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-120-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-121-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-122-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-123-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-124-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-126-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-127-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-128-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-129-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-130-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-131-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-132-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-133-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-125-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-134-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-135-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-136-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-137-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-138-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-139-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-141-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-142-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-144-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-146-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-147-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-148-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-150-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-152-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-153-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-154-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-151-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-149-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-145-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-143-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-140-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-155-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-157-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-156-0x0000000000A30000-0x0000000000BD8000-memory.dmp

    Filesize

    1.7MB

  • memory/4492-158-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-159-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-160-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-161-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-162-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-163-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-164-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-165-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-166-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-167-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-168-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-169-0x00000000046A0000-0x00000000046C9000-memory.dmp

    Filesize

    164KB

  • memory/4492-170-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-171-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-172-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-173-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-174-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-175-0x0000000000E20000-0x0000000000E4A000-memory.dmp

    Filesize

    168KB

  • memory/4492-176-0x00000000046A0000-0x00000000046C9000-memory.dmp

    Filesize

    164KB

  • memory/4492-177-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-179-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-178-0x0000000077C40000-0x0000000077DCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-180-0x00000000046A0000-0x00000000046C9000-memory.dmp

    Filesize

    164KB