Analysis

  • max time kernel
    603s
  • max time network
    543s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-05-2023 17:49

General

  • Target

    RunDLL-1.bat

  • Size

    38B

  • MD5

    270b2579f9f9c0ddad07b81343c3a6f8

  • SHA1

    f8dee702280695964fb6ec95dce7f6dccbd4bbd6

  • SHA256

    7c88e92b8cccd53631c02f49dd0cf1cd713f590980501328e543f53c3df35140

  • SHA512

    0527172b5d5f26b4fcef8fc40ed509c5b39fb7d0c324cd68aeac7b778613da469e77a3b0a4e96b7de6d7594d78919702e72597160a9ac3e204c376ccbc628db7

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683720157

C2

197.2.238.177:443

78.130.215.67:443

82.127.153.75:2222

96.56.197.26:2083

89.114.140.100:443

2.237.150.131:2222

69.133.162.35:443

73.29.92.128:443

70.160.67.203:443

79.77.142.22:2222

73.207.160.219:443

12.172.173.82:2087

103.212.19.254:995

188.83.251.100:443

173.61.50.155:3389

87.223.95.250:443

66.180.226.58:2222

84.108.200.161:443

81.224.201.143:2222

70.28.50.223:1194

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RunDLL-1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\system32\rundll32.exe
      rundll32.exe Dropsically.Spinose print
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe Dropsically.Spinose print
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\SysWOW64\wermgr.exe
          C:\Windows\SysWOW64\wermgr.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Windows\SysWOW64\ping.exe
            ping -n 3 yahoo.com
            5⤵
            • Runs ping.exe
            PID:4844
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
            • Gathers network information
            PID:4548
          • C:\Windows\SysWOW64\whoami.exe
            whoami /all
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4252-119-0x0000000002A60000-0x0000000002A63000-memory.dmp

    Filesize

    12KB

  • memory/4252-120-0x0000000010000000-0x0000000010024000-memory.dmp

    Filesize

    144KB

  • memory/4292-125-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-126-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-127-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-130-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-131-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-132-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-133-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-135-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-137-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-138-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-140-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-146-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-153-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-159-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-160-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-161-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-176-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-179-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-180-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-181-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB

  • memory/4292-182-0x0000000000710000-0x0000000000734000-memory.dmp

    Filesize

    144KB