General

  • Target

    Agreement_112759a_Mar4.xll

  • Size

    2MB

  • Sample

    230320-h8ypjacc57

  • MD5

    1bbf299a2a819a723f480a64fb999cc2

  • SHA1

    b4672c884a01efe28371483a98b8552a1a5e8721

  • SHA256

    45335de9c54b236bf26bcc77c6822d794d37cdc9af4861918008d4c69ebd8892

  • SHA512

    d3f5b0c19ed459ccf3700fbc527d3e53ed0bb93adcb452e514f2b89339db6a82d1fb547a014e74f8bfb1272455f8e8c2642f93916375e3d07493f05b3ae13501

  • SSDEEP

    49152:WjrNd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:arNd028KEl39AdZ/6y+9M7RDPZB

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

qakbot

Version

404.266

Botnet

obama242

Campaign

1678805546

C2

92.239.81.124:443

176.202.46.81:443

2.49.58.47:2222

86.225.214.138:2222

74.66.134.24:443

213.31.90.183:2222

12.172.173.82:50001

202.187.87.178:995

70.53.96.223:995

92.154.45.81:2222

186.64.67.54:443

81.158.112.20:2222

190.191.35.122:443

68.173.170.110:8443

12.172.173.82:993

98.145.23.67:443

12.172.173.82:22

37.186.55.60:2222

84.216.198.124:6881

73.161.176.218:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      Agreement_112759a_Mar4.xll

    • Size

      2MB

    • MD5

      1bbf299a2a819a723f480a64fb999cc2

    • SHA1

      b4672c884a01efe28371483a98b8552a1a5e8721

    • SHA256

      45335de9c54b236bf26bcc77c6822d794d37cdc9af4861918008d4c69ebd8892

    • SHA512

      d3f5b0c19ed459ccf3700fbc527d3e53ed0bb93adcb452e514f2b89339db6a82d1fb547a014e74f8bfb1272455f8e8c2642f93916375e3d07493f05b3ae13501

    • SSDEEP

      49152:WjrNd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:arNd028KEl39AdZ/6y+9M7RDPZB

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Qakbot/Qbot

      Qbot or Qakbot is a sophisticated worm with banking capabilities.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Tasks