Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2023, 01:49

General

  • Target

    RR.lnk

  • Size

    1KB

  • MD5

    db1ff5d2699b70f0932f6ba65f5642cf

  • SHA1

    104b04eddf98e76c50e54fbd5645ec0f22c64035

  • SHA256

    6af7106256432463f4281e0ee44a499c8c7188b034f5428b5f1018bc22883de1

  • SHA512

    2e81a9472927a873bf05d700a591d72afe9ad006f2d46413b507690e5d9d4b9b18a71bd1f2f3d142d037d6e7c880857b6bb6b02620977d66cd779fd06ae9e664

Malware Config

Extracted

Family

qakbot

Version

404.9

Botnet

BB16

Campaign

1677046917

C2

47.21.51.138:443

72.80.7.6:50003

82.127.204.82:2222

49.175.72.56:443

201.244.108.183:995

122.184.143.82:443

102.156.253.86:443

74.58.71.237:443

47.21.51.138:995

77.86.98.236:443

71.31.101.183:443

136.232.184.134:995

86.225.214.138:2222

95.242.101.251:995

109.11.175.42:2222

90.78.138.217:2222

184.176.35.223:2222

35.143.97.145:995

202.186.177.88:443

114.79.180.14:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RR.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c vibrations\\disharmony.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Users\Admin\AppData\Local\Temp\vibrations\smirch.exe
        vibrations\smirch.exe -decode vibrations\stateswoman.sql c:\users\public\output.txt
        3⤵
          PID:2304
        • C:\Users\Admin\AppData\Local\Temp\vibrations\smirch.exe
          vibrations\smirch.exe -decode c:\users\public\output.txt c:\users\public\output2.txt
          3⤵
            PID:2020
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 c:\users\public\output2.txt,N115
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1160
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 544
              4⤵
              • Program crash
              PID:3472
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1900
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1160 -ip 1160
        1⤵
          PID:2976

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Public\output2.txt

          Filesize

          904KB

          MD5

          e167b519cf6baad2089f2bec22012ead

          SHA1

          ba000e9403ce92eab037edca6f92eaf6cbbcb8f5

          SHA256

          8152566ab0b74913edaf3cfdc1d5f44d157d6b35545a782c2f5dcf40dc0c5cbe

          SHA512

          56838ee5dc29457efce3e8923290fbcb82d669844d2453d4ed8bf6688ceaa723c4050c83026f0572c568651e91a41a0bab6ae6c58b8be5821452fa8161d65a8d

        • \??\c:\users\public\output.txt

          Filesize

          1.2MB

          MD5

          89fc5ce67cf242cc5b83d8faa7b5e51d

          SHA1

          8e895df0b516a0c62b95f54643c90e67395f63ae

          SHA256

          55fbd2380d89035f0ac744c832ba6f27e3430ae877c3b013cfb8b3577e2a4ad6

          SHA512

          4aac5fdc2f1e374f2ead608856b087156dda368e0fba523ea1693e6dc1a9332db46bca2c78b2c70bbb8bf5840e353728c991519deebaa4a45bcc4b8eb3dcd91e

        • \??\c:\users\public\output2.txt

          Filesize

          904KB

          MD5

          e167b519cf6baad2089f2bec22012ead

          SHA1

          ba000e9403ce92eab037edca6f92eaf6cbbcb8f5

          SHA256

          8152566ab0b74913edaf3cfdc1d5f44d157d6b35545a782c2f5dcf40dc0c5cbe

          SHA512

          56838ee5dc29457efce3e8923290fbcb82d669844d2453d4ed8bf6688ceaa723c4050c83026f0572c568651e91a41a0bab6ae6c58b8be5821452fa8161d65a8d

        • memory/1160-145-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/1160-143-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/1160-144-0x00000000011F0000-0x00000000011F3000-memory.dmp

          Filesize

          12KB

        • memory/1160-138-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/1160-146-0x000000006D700000-0x000000006D7D1000-memory.dmp

          Filesize

          836KB

        • memory/1900-148-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-149-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-150-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-151-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-152-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-154-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB

        • memory/1900-156-0x0000000000120000-0x0000000000143000-memory.dmp

          Filesize

          140KB