Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
Resource
win7-20240221-en
General
-
Target
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
-
Size
1.3MB
-
MD5
5fec958eac0d6cd761e99616b86f9cf2
-
SHA1
fe0515cb74a579b293b3ea2d2cd88b0192326455
-
SHA256
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699
-
SHA512
7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c
-
SSDEEP
24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8
Malware Config
Extracted
qakbot
bmw01
1706268333
116.202.110.87:443
77.73.39.175:32103
185.156.172.62:443
185.117.90.142:6882
-
camp_date
2024-01-26 11:25:33 +0000 UTC
Signatures
-
Detect Qakbot Payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-5-0x00000000020E0000-0x000000000212E000-memory.dmp family_qakbot_v5 behavioral2/memory/416-4-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-7-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/3040-6-0x0000000002150000-0x00000000021A3000-memory.dmp family_qakbot_v5 behavioral2/memory/416-3-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-2-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-8-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-9-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/3040-10-0x0000000002150000-0x00000000021A3000-memory.dmp family_qakbot_v5 behavioral2/memory/416-12-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-11-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-13-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-14-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/416-15-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/860-17-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/416-23-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/860-24-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/416-26-0x0000000140000000-0x0000000140030000-memory.dmp family_qakbot_v5 behavioral2/memory/860-25-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-27-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-37-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-38-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-39-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-41-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-40-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 behavioral2/memory/860-43-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp family_qakbot_v5 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedescription pid process target process PID 3040 set thread context of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe -
Modifies registry class 10 IoCs
Processes:
wermgr.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\e6497274 = a6e9acc9f0cbaa06c07386c6a947995bee25656b9de26a01f686c901e5252af10f9355078ff6fef637623cc5ceaa32b69e9b210984be782652aac3fdf1b61ccf69bf10e0195791500127208dc7c80d0fde7e1763e281e4cc6403e9df5f78cfb72cb2dbb1b94c0cf385da92a4189feefbd455c21781fb65183e2eb581f9d9a64675 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\2ae372ea = 85529eaa950f0499414403f3bb2d9057cf1f809143bfa38711274206a68259db10f0a6c69a8e159639ff2ae2812eb8fb85d2e35cdd28dfe8d1061ebb6557da520d wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\f88134d8 = e77938233cfaf2de330f35688d92bec1f4846f94cc15cfb525f4429724067f62d78d5f797696eea38a6eb14c1fc78e526cd9e6dbf35232863b3e8c7b7b0c25717b4582112d9d22d393dd47b8f5e64984364e27a8c47c3145d5c18ff680a6e4594fa8bd8ed3846927333a896c7a943451849a87567bcdb1008ad475dc4a9d150ec78085d15106cef30cf46719968226bea0 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\35ac69c1 = 44550dfc4769d957f36e313b95dcbd0925fa4917a9e0cf6903caf47a8261d205c08ea218cb25f106db17ed0e247d01103f wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\f906695f = e77f877b65aa2d14cf0f7a7889230f90268077333c8f472dade95825367dbeccdc537342c3739dbee74da7850cb7b45b3c wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\342b3446 = 2588d232c569076e36429e585cb9825fee41fbe7a89a1b96b8e1670e54fa6251e8f105e43f5b9f4da036ea089d79aa10edf9712de54a871338a5cc511a0d49c33f13730beee016d55c7afb94d94835860c65247325bcee8533fb132d400ea0fcd051b17ef6c3453f00f91b08186585e0504d54766e2fab46575b24f61616e1a6dfe3b4c09a966720623b3a729c23a984ef wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\af2e2197 = 442b305a8ec5988a9e6bacad178f9ab17e8e2f18f9c8218d47f69e2572bb3b3b0f66cc789da920169e97243801fa2ace7863ede8b818fc5ce389a35d323734e2f8a78ea4812fb36c98083baaad27403f26 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\aea97c10 = 47929cbb7e652520fc58d1de5919480739e5ef115949beb0d17b73f7ef0d5c4291938ad300fcbfe6ed5c3d3c83d03edacf56f02cd92a358e98c6e4d2eb3428a634 wermgr.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\aea97c10 = 64fb85e233b1c7c8b3ef2ba88dcc054d06b2101cf96498d6f0177a735087f2ec09 wermgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exewermgr.exepid process 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe 860 wermgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedescription pid process target process PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 3040 wrote to memory of 416 3040 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe PID 416 wrote to memory of 860 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe wermgr.exe PID 416 wrote to memory of 860 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe wermgr.exe PID 416 wrote to memory of 860 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe wermgr.exe PID 416 wrote to memory of 860 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe wermgr.exe PID 416 wrote to memory of 860 416 dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\System32\wermgr.exeC:\Windows\System32\wermgr.exe3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/416-14-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-1-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-0-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-7-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-15-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-3-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-2-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-12-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-8-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-9-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-26-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-23-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-11-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-13-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/416-4-0x0000000140000000-0x0000000140030000-memory.dmpFilesize
192KB
-
memory/860-27-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-39-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-17-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-16-0x000001F2BBF60000-0x000001F2BBF62000-memory.dmpFilesize
8KB
-
memory/860-24-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-43-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-25-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-40-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-37-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-38-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/860-41-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmpFilesize
192KB
-
memory/3040-6-0x0000000002150000-0x00000000021A3000-memory.dmpFilesize
332KB
-
memory/3040-5-0x00000000020E0000-0x000000000212E000-memory.dmpFilesize
312KB
-
memory/3040-10-0x0000000002150000-0x00000000021A3000-memory.dmpFilesize
332KB