Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-10-2024 11:40

General

  • Target

    12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll

  • Size

    898KB

  • MD5

    88bbf2a743baaf81f7a312be61f90d76

  • SHA1

    3719aabc29d5eb58d5d2d2a37066047c67bfc2c6

  • SHA256

    12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305

  • SHA512

    b01f955eb5f840e01f1f65d5f19c0963e155b1f8d03b4e0720eccbd397cc9aee9a19a63000719e3cf8f580573a335bd61f39fe1261f44e1d5371a9c695b60b70

  • SSDEEP

    24576:qTm4c0TXhxdmVQGn88R7XM3Ljluc9KEaJqCjh0LmK8:6jP8Q13LjluSrCj+q/

Malware Config

Extracted

Family

qakbot

Botnet

tchk07

Campaign

1702975817

C2

116.203.56.11:443

109.107.181.8:443

Attributes
  • camp_date

    2023-12-19 08:50:17 +0000 UTC

Signatures

  • Detect Qakbot Payload 3 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\System32\wermgr.exe
      C:\Windows\System32\wermgr.exe
      2⤵
        PID:2780

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2400-0-0x0000000001D50000-0x0000000001D7F000-memory.dmp

      Filesize

      188KB

    • memory/2400-5-0x0000000001D80000-0x0000000001DAE000-memory.dmp

      Filesize

      184KB

    • memory/2400-4-0x0000000001D20000-0x0000000001D4D000-memory.dmp

      Filesize

      180KB

    • memory/2780-9-0x0000000000090000-0x0000000000092000-memory.dmp

      Filesize

      8KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.