Analysis

  • max time kernel
    149s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2023, 02:08

General

  • Target

    RR.lnk

  • Size

    1KB

  • MD5

    e11e154ee90f27fa17050a139523939b

  • SHA1

    20bd4d6a8e35d438d4b19c74c4a2d4fe5453fbcc

  • SHA256

    e495000b075ced39574d17076457e30f36a45ba00cb87647e481ce004d09d306

  • SHA512

    8bfde446bc0ae8501906838b1df7a6358ec060e79058c9f8bb0e8fce021c6587fa06d698141ab9f0c9abc906bf343c3a1e774e08afbfeaecde041f38d281c4b1

Malware Config

Extracted

Family

qakbot

Version

404.9

Botnet

BB16

Campaign

1677046917

C2

47.21.51.138:443

72.80.7.6:50003

82.127.204.82:2222

49.175.72.56:443

201.244.108.183:995

122.184.143.82:443

102.156.253.86:443

74.58.71.237:443

47.21.51.138:995

77.86.98.236:443

71.31.101.183:443

136.232.184.134:995

86.225.214.138:2222

95.242.101.251:995

109.11.175.42:2222

90.78.138.217:2222

184.176.35.223:2222

35.143.97.145:995

202.186.177.88:443

114.79.180.14:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RR.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe" /q /c vibrations\\compartmentally.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Local\Temp\vibrations\disobeys.exe
        vibrations\disobeys.exe -decode vibrations\battlement.sql c:\users\public\output.txt
        3⤵
          PID:4480
        • C:\Users\Admin\AppData\Local\Temp\vibrations\disobeys.exe
          vibrations\disobeys.exe -decode c:\users\public\output.txt c:\users\public\output2.txt
          3⤵
            PID:404
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 c:\users\public\output2.txt,N115
            3⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 544
              4⤵
              • Program crash
              PID:4896
            • C:\Windows\SysWOW64\wermgr.exe
              C:\Windows\SysWOW64\wermgr.exe
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2308 -ip 2308
        1⤵
          PID:3744

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Public\output2.txt

          Filesize

          904KB

          MD5

          7ce287ab51dcd202541ee90a55ce92e8

          SHA1

          3c1b267fe8e2194791685705bf741faa1fca170d

          SHA256

          b11b016430c26ed5f6231a263a081518ae9120e828bbbc95460b226c065f0f33

          SHA512

          06c42a93348114eab0f87f3784371e6aeeb412464856b76ecfec3d9d93f22b89775660a59969dca8a180658e4261f83e78bb63baba575b23b8fb2fd5e817b0cc

        • \??\c:\users\public\output.txt

          Filesize

          1.2MB

          MD5

          bce6418ffca344d5fcb65c8efb878a4d

          SHA1

          f095cb88d9d9a1f3b234253de84ba18c1ee6aa65

          SHA256

          f5ab66855faa0be039d3447038644b31efe874de4a4de67b7744d17cbb46e93a

          SHA512

          50a1aaab3c113c3e1a82650ca91ecc61f62118b9dc71408240400736441baf307b9db1bca442351142d545e8ee117c2369443c1c2356322575e260ceecd0cef1

        • \??\c:\users\public\output2.txt

          Filesize

          904KB

          MD5

          7ce287ab51dcd202541ee90a55ce92e8

          SHA1

          3c1b267fe8e2194791685705bf741faa1fca170d

          SHA256

          b11b016430c26ed5f6231a263a081518ae9120e828bbbc95460b226c065f0f33

          SHA512

          06c42a93348114eab0f87f3784371e6aeeb412464856b76ecfec3d9d93f22b89775660a59969dca8a180658e4261f83e78bb63baba575b23b8fb2fd5e817b0cc

        • memory/2308-138-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/2308-143-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/2308-144-0x00000000013C0000-0x00000000013C3000-memory.dmp

          Filesize

          12KB

        • memory/2308-145-0x0000000010000000-0x0000000010023000-memory.dmp

          Filesize

          140KB

        • memory/2308-146-0x000000006D700000-0x000000006D7D1000-memory.dmp

          Filesize

          836KB

        • memory/2968-149-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-150-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-151-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-152-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-153-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-154-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-155-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB

        • memory/2968-157-0x0000000000AE0000-0x0000000000B03000-memory.dmp

          Filesize

          140KB