Analysis

  • max time kernel
    158s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2023 11:07

General

  • Target

    distantly.dll

  • Size

    682KB

  • MD5

    5f1e08625d65bb93e8bf4611d2ee9070

  • SHA1

    56fc9eb319ac902ac7e26357bd4cc598a3644d38

  • SHA256

    7bfa0fc80cf1b4dc110356aad858ed3638985dce794286dfe9a25ff3869fed02

  • SHA512

    94de1f8c3da8439f6bee529cf6e4d10979ca757af0b30f27b7d9f2d0dbbd18051c9b49e3c7470c2c271bbf1221986497e266168ff9a2d47d5b47924eac7fd011

  • SSDEEP

    12288:dDxy+2MIBYYimb3oG11xfTUOz3dluiIIN:Vg+2MIBYkb4G11hTsi

Malware Config

Extracted

Family

qakbot

Version

404.1346

Botnet

BB30

Campaign

1685686808

C2

86.173.2.12:2222

92.9.45.20:2222

100.4.163.158:2222

213.64.33.92:2222

75.98.154.19:443

78.192.109.105:2222

88.126.94.4:50000

70.28.50.223:2083

92.154.17.149:2222

24.234.220.88:993

87.252.106.39:995

174.4.89.3:443

12.172.173.82:20

90.29.86.138:2222

70.160.67.203:443

223.166.13.95:995

184.181.75.148:443

95.45.50.93:2222

201.143.215.69:443

64.121.161.102:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\distantly.dll,next
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\distantly.dll,next
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1496-139-0x0000000000FD0000-0x0000000000FD2000-memory.dmp

    Filesize

    8KB

  • memory/1496-140-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-146-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-148-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-149-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-150-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-151-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/1496-154-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

    Filesize

    144KB

  • memory/5024-133-0x0000000001090000-0x0000000001093000-memory.dmp

    Filesize

    12KB

  • memory/5024-134-0x0000000010000000-0x0000000010024000-memory.dmp

    Filesize

    144KB

  • memory/5024-147-0x000000006AD80000-0x000000006AE18000-memory.dmp

    Filesize

    608KB