Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2023, 01:54

General

  • Target

    RR.lnk

  • Size

    1KB

  • MD5

    116043c27c54721a59fa3e47186ec052

  • SHA1

    4d9dcb94a693af74efd935f1b0867fbe8009e39e

  • SHA256

    af2bf4c628f6b1cf815e9d5b898ec10334da7fc709436903d8f9a6dd68fcf392

  • SHA512

    231ba488f405044aed8231a4e2d0303be49b46b0486c63ee6ddb72a8b0a895b89b486cc26b06524d84590ee19241352d95a040057c2a51d418985aeab372f7c7

Malware Config

Extracted

Family

qakbot

Version

404.9

Botnet

BB16

Campaign

1677046917

C2

47.21.51.138:443

72.80.7.6:50003

82.127.204.82:2222

49.175.72.56:443

201.244.108.183:995

122.184.143.82:443

102.156.253.86:443

74.58.71.237:443

47.21.51.138:995

77.86.98.236:443

71.31.101.183:443

136.232.184.134:995

86.225.214.138:2222

95.242.101.251:995

109.11.175.42:2222

90.78.138.217:2222

184.176.35.223:2222

35.143.97.145:995

202.186.177.88:443

114.79.180.14:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RR.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c vibrations\\curtness.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\vibrations\unmeticulous.exe
        vibrations\unmeticulous.exe -decode vibrations\thriftlessness.sql c:\users\public\output.txt
        3⤵
          PID:1832
        • C:\Users\Admin\AppData\Local\Temp\vibrations\unmeticulous.exe
          vibrations\unmeticulous.exe -decode c:\users\public\output.txt c:\users\public\output2.txt
          3⤵
            PID:3236
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 c:\users\public\output2.txt,N115
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3972
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 544
              4⤵
              • Program crash
              PID:2596
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3972 -ip 3972
        1⤵
          PID:2976

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Public\output2.txt

          Filesize

          904KB

          MD5

          c45edab97e4d8530994f4348836b6908

          SHA1

          6814a0c947524f1997970e496eac380f5e4b2b55

          SHA256

          e9f82251f1a1408f9bfe31f60c6d67d8df0cc08f35dd010d63e7a996813c68e4

          SHA512

          ba2395e85363ea878758e96a47362e7132bc447ca325863f35a99aeba327e4cc0b3180b5e768a79da91c4278a6ff344c58040023f2eb6087e2bbc4f6c7473330

        • \??\c:\users\public\output.txt

          Filesize

          1.2MB

          MD5

          a1e20cd6b72079c2ed16419518c7cd62

          SHA1

          660f1c063b62871a6dc8fcfa2df26ae3773634d7

          SHA256

          e83a4d87c62b7eb48921c18c034c4d75e2c1f060a155dc08d9b0b1de578a6010

          SHA512

          2021d6114a4a011e3aa9ae44ffdbdcd447fe9029a90345635c12bf9391c0072c876556efcf3df51d771a2a9935ab26de43c058fc6d4e358bca2d1ee97d7dc489

        • \??\c:\users\public\output2.txt

          Filesize

          904KB

          MD5

          c45edab97e4d8530994f4348836b6908

          SHA1

          6814a0c947524f1997970e496eac380f5e4b2b55

          SHA256

          e9f82251f1a1408f9bfe31f60c6d67d8df0cc08f35dd010d63e7a996813c68e4

          SHA512

          ba2395e85363ea878758e96a47362e7132bc447ca325863f35a99aeba327e4cc0b3180b5e768a79da91c4278a6ff344c58040023f2eb6087e2bbc4f6c7473330

        • memory/3972-138-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/3972-143-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/3972-144-0x0000000000E20000-0x0000000000E23000-memory.dmp

          Filesize

          12KB

        • memory/3972-145-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/3972-146-0x000000006D700000-0x000000006D7D1000-memory.dmp

          Filesize

          836KB

        • memory/4360-148-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-149-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-150-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-151-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-152-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-153-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-154-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB

        • memory/4360-156-0x0000000000800000-0x0000000000823000-memory.dmp

          Filesize

          140KB