Analysis
-
max time kernel
151s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 15:02
Static task
static1
Behavioral task
behavioral1
Sample
qbot.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
qbot.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
qbot.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
qbot.dll
Resource
win10v2004-20230220-en
General
-
Target
qbot.bat
-
Size
26B
-
MD5
2aabd1a3d885eaf151f9fc101ea1caab
-
SHA1
6fcf6a07c0f9a23826bab9fd4da093ed4757019c
-
SHA256
9ae4c3b9e654237f9d62c93dbd242ed64abe72451e7d142724bfea801cd6c4de
-
SHA512
9df02859f59a52d216f80b9627bf6d43eac8762120701625d39ef52bed7343d4b32b9596070533593f7eeecd5f134d8dfbe14117ea6ea9378908cbf4692b8da0
Malware Config
Extracted
qakbot
404.1358
obama267
1686127648
161.142.100.114:995
116.75.63.15:443
125.99.76.102:443
93.187.148.45:443
79.168.224.165:2222
31.53.29.216:2222
103.123.223.133:443
62.35.230.21:995
124.149.143.189:2222
109.50.149.241:2222
86.222.101.244:2222
45.62.70.33:443
24.234.220.88:995
201.244.108.183:995
190.75.134.240:2222
103.212.19.254:995
184.182.66.109:443
64.121.161.102:443
178.175.187.254:443
94.59.123.30:2222
70.28.50.223:3389
86.98.20.183:443
70.28.50.223:32100
66.241.183.99:443
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
78.159.147.185:995
12.172.173.82:22
2.14.232.15:2222
96.56.197.26:2078
92.188.241.102:443
72.134.124.16:443
70.28.50.223:2083
72.205.104.134:443
62.102.228.245:2222
165.120.169.171:2222
83.249.198.100:2222
102.159.32.187:443
41.227.190.59:443
95.45.50.93:2222
105.186.128.187:995
189.223.184.79:443
213.64.33.92:2222
75.98.154.19:443
103.139.242.6:443
124.122.47.148:443
103.144.201.48:2078
103.87.128.228:443
125.99.69.178:443
103.113.68.33:443
100.6.31.96:443
197.86.195.172:443
114.143.176.236:443
96.56.197.26:2222
12.172.173.82:995
12.172.173.82:20
70.160.67.203:443
92.9.45.20:2222
24.234.220.88:990
122.184.143.86:443
174.4.89.3:443
70.28.50.223:2087
82.127.153.75:2222
98.4.43.111:443
74.12.144.156:2083
88.126.94.4:50000
79.77.142.22:2222
147.219.4.194:443
90.29.86.138:2222
151.62.164.49:443
149.74.159.67:2222
184.181.75.148:443
74.14.39.7:2222
24.198.114.130:995
74.12.144.156:2078
213.91.235.146:443
77.86.98.236:443
24.234.220.88:993
92.20.204.198:2222
147.147.30.126:2222
70.64.77.115:443
188.28.19.84:443
12.172.173.82:50001
198.2.51.242:993
47.34.30.133:443
92.186.69.229:2222
92.154.17.149:2222
86.189.153.214:443
12.172.173.82:465
49.175.72.188:443
84.215.202.8:443
86.248.228.57:2078
89.129.109.27:2222
12.172.173.82:21
75.109.111.89:443
1.221.179.74:443
220.240.164.182:443
65.95.141.177:2222
197.204.81.71:443
12.172.173.82:2087
94.204.195.51:443
47.21.51.138:443
77.126.99.230:443
176.142.207.63:443
12.172.173.82:32101
70.28.50.223:1194
86.195.14.72:2222
93.187.148.45:995
199.27.66.213:443
24.234.220.88:465
213.55.33.103:443
113.11.92.30:443
176.133.4.230:995
85.57.212.13:3389
183.87.163.165:443
70.49.205.198:2222
121.121.100.202:995
84.216.198.201:6881
81.229.117.95:2222
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 1752 rundll32.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe 1740 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 884 wrote to memory of 1144 884 cmd.exe rundll32.exe PID 884 wrote to memory of 1144 884 cmd.exe rundll32.exe PID 884 wrote to memory of 1144 884 cmd.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1144 wrote to memory of 1752 1144 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe PID 1752 wrote to memory of 1740 1752 rundll32.exe wermgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\qbot.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\rundll32.exerundll32.exe qbot.dll,menu2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe qbot.dll,menu3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740