Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-04-2024 13:35

General

  • Target

    2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

  • Size

    1.3MB

  • MD5

    041f11543edf5591a8fb7b0037e3d115

  • SHA1

    ee5fb2448d4437c2eaefdfb7cac13a0a2162a775

  • SHA256

    2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d

  • SHA512

    3e3e5634cb560178ec75b2a74a92a9bbacedf53f046491ebf9e2d7849b1b1ea5327cf9e8e3cc2ffc3938ca12d6ab281ae466b4446c2b338fa35976ef6f5b83c4

  • SSDEEP

    24576:6H4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:1G8P8VcrlcwLXPpL8

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Signatures

  • Detect Qakbot Payload 12 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
    "C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
      "C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2488 -s 224
        3⤵
          PID:2652

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2028-0-0x0000000000470000-0x00000000004BE000-memory.dmp
      Filesize

      312KB

    • memory/2028-1-0x00000000004C0000-0x0000000000513000-memory.dmp
      Filesize

      332KB

    • memory/2028-22-0x00000000004C0000-0x0000000000513000-memory.dmp
      Filesize

      332KB

    • memory/2488-5-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-8-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-11-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-14-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-17-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-20-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-2-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-21-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-23-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-24-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2488-25-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB