Analysis
-
max time kernel
300s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 13:31
General
-
Target
ioenou.exe
-
Size
130KB
-
MD5
479c596e0459402209859913aa4280ed
-
SHA1
3786faae5946919d23631bb69c8b6a07d5775abf
-
SHA256
28f49c8ec7e739247dc8fbaa421456efb5869b1d92181d2b99c93520064cbb5f
-
SHA512
0475695a4f8933b6afdf73eb3546fba4edcc47ad01f9dc9af2910a07fb89101bd2288fa91702b95d8c4a06abbbc4fe38a3b12abbc6f622a00d4c2400c9dac9ff
-
SSDEEP
3072:608q9D1i4yfNwvcKgi1AvuJ4I/YzTBfQzcoG5y:cfiEKxGvuJL/YzTBozcoG5y
Malware Config
Extracted
qakbot
404.1377
snow09
1686740620
101.184.155.156:2222
89.79.229.50:443
173.17.45.60:443
124.246.122.199:2222
84.215.202.8:443
122.184.143.86:443
79.168.224.165:2222
151.62.174.154:443
124.122.47.148:443
31.190.240.11:443
92.239.81.124:443
31.53.29.210:2222
172.115.17.50:443
70.28.50.223:2083
64.121.161.102:443
187.199.244.117:32103
91.68.227.219:443
176.142.207.63:443
47.199.241.39:443
89.129.109.27:2222
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ioenou.exe"C:\Users\Admin\AppData\Local\Temp\ioenou.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5198e6e13c85463164d278650be48fd33
SHA1b871b7b2ac23aa0d03775494a43f00b713e9848f
SHA25668a1d8c4b9ce251731d6c8b596dcb7c60b23b8127f7e7d0521f2f00e0de843ed
SHA5128454ed8b23da2ff5a475f5af5c0abab5bbece1b591db5cc7db99a20568f7aaf7c344231b913bd0cbe5dc8f2fec2b5ae43cfe71d59f20c5be857d0ca5e744a061
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB