Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-08-2024 11:14

General

  • Target

    6438/plugged.dll

  • Size

    386KB

  • MD5

    88f2abefd23b14fc8691710eccfb27a8

  • SHA1

    9b06af24a62d2760dbddc2ee7be531796c8552f8

  • SHA256

    7bf94324bf7ffd68800911283340439b03bcdbf5a97d45daed22f84b4f9883eb

  • SHA512

    3d65448493d8db946a30e129af0792a88d3093c544ec5b98118ff09b854055caa7558f12f334b0c350605c9a44fcf837992025ced5bdfea5657230ac2d165286

  • SSDEEP

    6144:XtgTFlqteWTBa5WsoUReNsyLK9d8WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN9WtniPHlQEFYM

Malware Config

Extracted

Family

qakbot

Version

403.914

Botnet

obama210

Campaign

1665041236

C2

41.104.205.128:443

134.35.6.76:443

197.202.163.4:443

181.164.194.228:443

105.159.124.224:443

197.158.89.85:443

41.96.33.236:443

181.141.3.126:443

123.22.7.132:443

163.182.177.80:443

41.248.72.229:8443

41.100.62.129:443

68.83.169.91:443

190.29.228.61:443

160.176.249.11:995

41.107.54.99:443

94.52.127.44:443

105.69.155.85:995

45.227.251.167:2222

197.206.141.97:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6438\plugged.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\6438\plugged.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-2-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-5-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-11-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-12-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-10-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-9-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-8-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-13-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/1740-15-0x0000000003080000-0x00000000030A2000-memory.dmp

    Filesize

    136KB

  • memory/4164-0-0x00000000044C0000-0x00000000044E2000-memory.dmp

    Filesize

    136KB

  • memory/4164-1-0x00000000044C0000-0x00000000044E2000-memory.dmp

    Filesize

    136KB

  • memory/4164-3-0x00000000044C0000-0x00000000044E2000-memory.dmp

    Filesize

    136KB