Overview
overview
10Static
static
1quakbotsamples.zip
windows7-x64
1quakbotsamples.zip
windows10-2004-x64
1quakbotsam...c1.dll
windows7-x64
10quakbotsam...c1.dll
windows10-2004-x64
10quakbotsam...e1.dll
windows7-x64
10quakbotsam...e1.dll
windows10-2004-x64
10quakbotsam...60.dll
windows7-x64
10quakbotsam...60.dll
windows10-2004-x64
10quakbotsam...1b.dll
windows7-x64
10quakbotsam...1b.dll
windows10-2004-x64
10quakbotsam...a1.dll
windows7-x64
10quakbotsam...a1.dll
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 21:35
Static task
static1
Behavioral task
behavioral1
Sample
quakbotsamples.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
quakbotsamples.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
quakbotsamples/29148f550d02cf98d89efb53f7137da28e91df43790f4fc052a0f405f99edcc1.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
quakbotsamples/29148f550d02cf98d89efb53f7137da28e91df43790f4fc052a0f405f99edcc1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
quakbotsamples/62b038f2dc2ab995d036930a2eaa5f2dc67fb0ab884459d3fa6df653eec307e1.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
quakbotsamples/62b038f2dc2ab995d036930a2eaa5f2dc67fb0ab884459d3fa6df653eec307e1.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
quakbotsamples/a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
quakbotsamples/a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
quakbotsamples/a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
quakbotsamples/a5bc6aad1c3205857cf8d29058f8a5283bdc743b9965b5b5d2e69df9a9b6bb1b.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
quakbotsamples/c59d033fa3a58112f7520113699c74552c4d12bb10783fa880359ec94affe2a1.dll
Resource
win7-20230220-en
General
-
Target
quakbotsamples/a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll
-
Size
294KB
-
MD5
118b1050be87b8189692b82df0ae3045
-
SHA1
f7ca1686e66866ce961a3b94bbee1d94b962a450
-
SHA256
a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60
-
SHA512
abe0ae20a6a7a93bdbfe2909185a646b8eae6fdf31de0a1b51f51c79bf845974345448d105cf004e91539dcb81ca6fa504db85b822599a857aeed1f1bb46e5fb
-
SSDEEP
3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH
Malware Config
Extracted
qakbot
401.51
abc104
1606818862
79.119.124.237:443
87.218.53.206:2222
181.169.88.203:443
82.12.157.95:995
94.49.188.240:443
46.124.107.124:6881
86.122.248.164:2222
83.202.68.220:2222
79.129.216.215:2222
37.21.231.245:995
47.187.49.3:2222
2.90.33.130:443
149.28.98.196:995
149.28.99.97:443
45.63.107.192:995
149.28.98.196:2222
45.63.107.192:2222
74.73.27.35:443
149.28.98.196:443
144.202.38.185:2222
149.28.99.97:2222
45.77.193.83:443
144.202.38.185:995
24.95.61.62:443
95.77.223.148:443
71.187.170.235:443
39.36.30.92:995
188.26.243.119:443
78.187.125.116:2222
2.7.202.106:2222
178.80.62.24:443
91.104.44.226:995
81.214.126.173:2222
94.98.242.243:443
31.5.21.66:995
80.14.22.234:2222
98.121.187.78:443
47.44.217.98:443
82.10.43.130:2222
103.102.100.78:2222
45.118.65.34:443
176.45.233.94:995
81.247.148.252:995
211.24.72.253:443
189.231.3.63:443
41.227.76.249:443
156.222.155.185:995
75.136.40.155:443
92.154.83.96:2087
37.211.86.156:443
72.36.59.46:2222
219.76.148.249:443
2.50.56.81:443
47.21.192.182:2222
96.225.88.23:443
197.86.204.38:443
93.146.133.102:2222
96.21.251.127:2222
184.98.97.227:995
58.179.21.147:995
86.98.60.176:443
37.210.133.63:995
24.27.82.216:2222
82.127.125.209:20
79.115.171.106:2222
193.248.154.174:2222
172.78.30.215:443
79.166.96.86:2222
72.66.47.70:443
89.87.231.187:2222
72.29.181.78:2222
161.142.217.62:443
109.154.193.21:2222
86.245.87.251:2222
2.88.67.161:995
198.2.35.226:2222
83.110.206.115:995
2.89.183.206:443
151.16.241.219:443
110.142.205.182:443
85.98.177.32:443
78.181.19.134:443
102.185.242.27:443
90.101.117.122:2222
78.96.199.79:443
68.39.160.40:80
84.117.176.32:443
65.30.213.13:6882
42.201.228.106:995
80.195.103.146:2222
77.145.0.57:2222
94.59.236.155:995
1.43.86.247:2222
85.121.42.12:995
71.10.43.79:443
105.198.236.99:443
140.82.27.132:443
39.45.175.245:995
45.32.162.253:443
45.32.165.134:443
217.162.149.212:443
59.96.59.100:443
2.51.246.190:995
197.45.110.165:995
86.99.134.235:2222
24.179.13.119:443
176.181.247.197:443
68.131.19.52:443
86.98.34.84:995
184.21.136.237:995
65.131.47.74:995
185.105.131.233:443
81.133.234.36:2222
84.120.99.206:443
41.233.154.10:993
181.208.249.141:443
92.154.83.96:2222
92.154.83.96:1194
92.137.138.52:2222
175.140.23.200:443
46.177.174.186:443
203.106.195.67:443
172.87.157.235:443
121.58.199.24:443
151.60.163.18:443
73.51.245.231:995
37.210.131.246:443
151.27.89.199:443
41.237.210.179:995
94.69.112.148:2222
96.41.93.96:443
41.97.183.51:443
37.130.115.124:443
93.113.177.152:443
197.206.132.79:443
197.51.82.115:995
85.122.141.42:995
118.70.55.146:443
156.205.103.107:995
59.99.37.18:443
185.163.221.77:2222
39.32.55.12:995
62.38.114.12:2222
50.60.166.59:995
5.193.115.251:2222
58.152.9.133:443
196.151.252.84:443
120.151.95.167:443
178.222.114.132:995
97.119.234.37:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1100 rundll32.exe 1100 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 912 wrote to memory of 1100 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1100 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1100 912 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\quakbotsamples\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\quakbotsamples\a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses