Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 10:06
Static task
static1
Behavioral task
behavioral1
Sample
fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
Resource
win7-20240221-en
General
-
Target
fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
-
Size
1.3MB
-
MD5
f9073d4ac3089ecc2c43b73b3818582e
-
SHA1
38813f19e54d28055b2cc4d7030cf608ca5d4c5a
-
SHA256
fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92
-
SHA512
bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35
-
SSDEEP
24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6
Malware Config
Extracted
qakbot
bmw01
1706268333
116.202.110.87:443
77.73.39.175:32103
185.156.172.62:443
185.117.90.142:6882
-
camp_date
2024-01-26 11:25:33 +0000 UTC
Signatures
-
Detect Qakbot Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-1-0x0000000000430000-0x000000000047E000-memory.dmp family_qakbot_v5 behavioral1/memory/2156-3-0x0000000000480000-0x00000000004D3000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-8-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-11-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-14-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-17-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-20-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2156-22-0x0000000000480000-0x00000000004D3000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-21-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-23-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-24-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral1/memory/2160-25-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exedescription pid process target process PID 2156 set thread context of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exefda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exedescription pid process target process PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2156 wrote to memory of 2160 2156 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe PID 2160 wrote to memory of 2604 2160 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe WerFault.exe PID 2160 wrote to memory of 2604 2160 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe WerFault.exe PID 2160 wrote to memory of 2604 2160 fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2160 -s 2243⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-1-0x0000000000430000-0x000000000047E000-memory.dmpFilesize
312KB
-
memory/2156-22-0x0000000000480000-0x00000000004D3000-memory.dmpFilesize
332KB
-
memory/2156-3-0x0000000000480000-0x00000000004D3000-memory.dmpFilesize
332KB
-
memory/2160-5-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-8-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-11-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-14-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-17-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-20-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-0-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-21-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-23-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-24-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/2160-25-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB