Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02-04-2024 13:35

General

  • Target

    fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

  • Size

    1.3MB

  • MD5

    f9073d4ac3089ecc2c43b73b3818582e

  • SHA1

    38813f19e54d28055b2cc4d7030cf608ca5d4c5a

  • SHA256

    fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92

  • SHA512

    bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35

  • SSDEEP

    24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes
  • camp_date

    2024-01-26 11:25:33 +0000 UTC

Signatures

  • Detect Qakbot Payload 12 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
    "C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
      "C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2044 -s 224
        3⤵
          PID:2548

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2044-11-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-21-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-4-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-25-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-20-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-23-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-24-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-17-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-8-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-0-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2044-14-0x0000000140000000-0x0000000140030000-memory.dmp
      Filesize

      192KB

    • memory/2168-3-0x0000000001B90000-0x0000000001BDE000-memory.dmp
      Filesize

      312KB

    • memory/2168-22-0x0000000001BE0000-0x0000000001C33000-memory.dmp
      Filesize

      332KB

    • memory/2168-5-0x0000000001BE0000-0x0000000001C33000-memory.dmp
      Filesize

      332KB