Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2023 17:49

General

  • Target

    RunDLL-1.bat

  • Size

    38B

  • MD5

    270b2579f9f9c0ddad07b81343c3a6f8

  • SHA1

    f8dee702280695964fb6ec95dce7f6dccbd4bbd6

  • SHA256

    7c88e92b8cccd53631c02f49dd0cf1cd713f590980501328e543f53c3df35140

  • SHA512

    0527172b5d5f26b4fcef8fc40ed509c5b39fb7d0c324cd68aeac7b778613da469e77a3b0a4e96b7de6d7594d78919702e72597160a9ac3e204c376ccbc628db7

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683720157

C2

197.2.238.177:443

78.130.215.67:443

82.127.153.75:2222

96.56.197.26:2083

89.114.140.100:443

2.237.150.131:2222

69.133.162.35:443

73.29.92.128:443

70.160.67.203:443

79.77.142.22:2222

73.207.160.219:443

12.172.173.82:2087

103.212.19.254:995

188.83.251.100:443

173.61.50.155:3389

87.223.95.250:443

66.180.226.58:2222

84.108.200.161:443

81.224.201.143:2222

70.28.50.223:1194

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\RunDLL-1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\system32\rundll32.exe
      rundll32.exe Dropsically.Spinose print
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe Dropsically.Spinose print
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\wermgr.exe
          C:\Windows\SysWOW64\wermgr.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\Windows\SysWOW64\ping.exe
            ping -n 3 yahoo.com
            5⤵
            • Runs ping.exe
            PID:980
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
            • Gathers network information
            PID:2036
          • C:\Windows\SysWOW64\whoami.exe
            whoami /all
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:900
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    081bf738abe7efb6687ff2a64fd44cc5

    SHA1

    9418a60156038f22c57734c5105fad3aa530e3fc

    SHA256

    69b53a80286ddc02c3ce2191abe63388de7732fc42886b03caa77bab17e62e65

    SHA512

    552dba8f8069274dae2cd6c6c2a6821ef7076c62d885bcdae6d91294211c6a07fd396a2599acb9bbd5e8c83a6acc23d465678218f3f27d37bc146b5b76ab6774

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    e21eed460985b69dae4c53ef60ced22c

    SHA1

    6119e6c4634ac155ce5e2f1844bc4adcf25cf442

    SHA256

    8e9d0a5cdbf6dbd65844587293b9ff7bb183a0a40742ff54ec135f7624cb232e

    SHA512

    12d8a73d4aa203001aa8fb4fa93c6dd150f8394b105a862cb5e608013d1e4459cee02f3850d82e63cf401e8e4f6dadd41563a7a8caec084676f2f44fa04f8933

  • C:\Users\Admin\AppData\Local\Temp\Tar3E40.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/1236-55-0x0000000010000000-0x0000000010024000-memory.dmp

    Filesize

    144KB

  • memory/1236-54-0x0000000000130000-0x0000000000133000-memory.dmp

    Filesize

    12KB

  • memory/1504-578-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-582-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-69-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-72-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-73-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-75-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-66-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-65-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-64-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-579-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-581-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-67-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-63-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-62-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-661-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-662-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-663-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-61-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-60-0x0000000000080000-0x0000000000082000-memory.dmp

    Filesize

    8KB

  • memory/1504-1741-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-1768-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-1769-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-1770-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/1504-1771-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB