Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
- submitted
21/06/2023, 15:09
General
- Target posstt.dll
- Size 1.1MB
- Sample230621-sjs3vsbd7t
- SHA256 72c28bc50f1983d49271271df5c7317cc3cc98db6eb4a0f787125b2ad43d7c4b
Malware Config
Extracted
-
qakbot
-
404.1382
-
BB33
-
1687343976
-
149.74.159.67:2222
-
184.176.35.223:2222
-
87.149.121.9:995
-
89.129.109.27:2222
-
151.62.196.183:443
-
24.198.114.130:995
-
96.87.28.170:2222
-
213.55.33.103:443
-
12.172.173.82:22
-
41.228.207.158:995
-
90.162.45.154:2222
-
102.130.200.134:2078
-
64.43.14.50:443
-
198.2.51.242:993
-
47.34.30.133:443
-
70.51.247.250:2222
-
168.149.47.12:443
-
68.186.65.132:443
-
88.126.94.4:50000
-
70.28.50.223:3389
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\posstt.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\posstt.dll,#12⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" .\posstt.dll,more2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" .\posstt.dll,more3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_vhote54w.ga5.ps1
memory/1884-153-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/1884-147-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/1884-146-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/1884-144-0x00000262BAB00000-0x00000262BAB22000-memory.dmp
memory/1884-148-0x00000262D4090000-0x00000262D40D4000-memory.dmp
memory/1884-149-0x00000262D4160000-0x00000262D41D6000-memory.dmp
memory/1884-150-0x00000262D4060000-0x00000262D407E000-memory.dmp
memory/1884-151-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/1884-145-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/1884-152-0x00000262D3170000-0x00000262D3180000-memory.dmp
memory/2308-164-0x0000000000130000-0x0000000000154000-memory.dmp
memory/2308-163-0x0000000000160000-0x0000000000162000-memory.dmp
memory/2308-170-0x0000000000130000-0x0000000000154000-memory.dmp
memory/2308-171-0x0000000000130000-0x0000000000154000-memory.dmp
memory/2308-172-0x0000000000130000-0x0000000000154000-memory.dmp
memory/2308-173-0x0000000000130000-0x0000000000154000-memory.dmp
memory/2308-174-0x0000000000130000-0x0000000000154000-memory.dmp
memory/3348-158-0x0000000010000000-0x0000000010024000-memory.dmp
memory/3348-157-0x0000000000A50000-0x0000000000A53000-memory.dmp