Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24-08-2024 18:18

General

  • Target

    03a10a91d7feb7f25827a0f5394c5ceea549be62510af5db0d96874ce1003a4d.dll

  • Size

    330KB

  • MD5

    a29f152bd17637fd1685728c101288ad

  • SHA1

    8495fc8504275f867c027a1c44ba577c41a2ae6a

  • SHA256

    03a10a91d7feb7f25827a0f5394c5ceea549be62510af5db0d96874ce1003a4d

  • SHA512

    ce45e4fa0f32cbb538daccdb8d7d03a472fe1d354a7b777dcef80e408a13d1d925e61d07bb49891cc5f62553c8f2ade6a02ec19f12318b157f68efdda49ae93a

  • SSDEEP

    6144:PMFAeiNMFr8XJdk6lm+sn0jWqz1BOSxYgtfnaF5RSUYH5iVe0Ho8X1QCMeDVPYEN:PaAir8hoGWqz1USGmfnI5RuHqep8FQPo

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

biden52

Campaign

1622646137

C2

184.185.103.157:443

71.187.170.235:443

86.220.62.251:2222

75.67.192.125:443

96.61.23.88:995

92.96.3.180:2078

72.252.201.69:443

24.152.219.253:995

105.198.236.101:443

24.179.77.236:443

189.210.115.207:443

81.97.154.100:443

47.22.148.6:443

45.77.115.208:443

149.28.98.196:443

45.77.115.208:2222

144.202.38.185:995

45.77.115.208:8443

207.246.77.75:8443

207.246.77.75:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\03a10a91d7feb7f25827a0f5394c5ceea549be62510af5db0d96874ce1003a4d.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\03a10a91d7feb7f25827a0f5394c5ceea549be62510af5db0d96874ce1003a4d.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 216
        3⤵
        • Program crash
        PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1500-0-0x00000000001D0000-0x0000000000226000-memory.dmp

    Filesize

    344KB

  • memory/1500-1-0x0000000000300000-0x000000000033D000-memory.dmp

    Filesize

    244KB

  • memory/1500-2-0x0000000000380000-0x00000000003BD000-memory.dmp

    Filesize

    244KB

  • memory/1500-5-0x0000000000380000-0x00000000003BD000-memory.dmp

    Filesize

    244KB

  • memory/1500-3-0x0000000000380000-0x00000000003BD000-memory.dmp

    Filesize

    244KB

  • memory/1500-6-0x00000000001D0000-0x0000000000226000-memory.dmp

    Filesize

    344KB

  • memory/1500-7-0x0000000000300000-0x000000000033D000-memory.dmp

    Filesize

    244KB