qakbot | 1ca770c569104d9eb3ddb63c3993362563f978dab73e929aa746446536eb34b6

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-09-2022 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41b753aac59cfcc10c8e502f07bb34db.dll
Size

448KB
MD5

41b753aac59cfcc10c8e502f07bb34db
SHA1

499ca4ca00d6ae0d1cdc384b94b76e9513be461f
SHA256

1ca770c569104d9eb3ddb63c3993362563f978dab73e929aa746446536eb34b6
SHA512

fce78dad54e93b13615bd51804eb45bd018f5236fbc09cc2c771e8519be15fda30609775a5bc09117b9bc9952338e3799b7bcab573c3f5847a115e101e6c8ad6
SSDEEP

12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf

Score

10^/10

qakbot bb 1662650043 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.860

Botnet

Campaign

1662650043

191.97.234.238:995

81.131.161.131:2078

197.94.210.133:443

193.3.19.37:443

70.51.153.182:2222

99.232.140.205:2222

123.240.131.1:443

177.102.84.28:32101

105.156.152.227:443

190.59.247.136:995

89.211.218.88:2222

81.214.220.237:443

85.99.62.74:443

217.165.68.122:993

219.69.103.199:443

37.210.148.30:995

64.207.215.69:443

113.169.57.104:443

179.225.221.169:32101

151.234.94.35:990

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 984 WerFault.exe explorer.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1628 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1628 regsvr32.exe

pid	pid_target	process	target process
1744	984	WerFault.exe	explorer.exe

pid	process
1628	regsvr32.exe

pid	process
1628	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1480 wrote to memory of 1628	1480	regsvr32.exe	regsvr32.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 1628 wrote to memory of 984	1628	regsvr32.exe	explorer.exe
PID 984 wrote to memory of 1744	984	explorer.exe	WerFault.exe
PID 984 wrote to memory of 1744	984	explorer.exe	WerFault.exe
PID 984 wrote to memory of 1744	984	explorer.exe	WerFault.exe
PID 984 wrote to memory of 1744	984	explorer.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\41b753aac59cfcc10c8e502f07bb34db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\41b753aac59cfcc10c8e502f07bb34db.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 404
4⤵
- Program crash
PID:1744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-60-0x0000000000000000-mapping.dmp

Download
memory/984-62-0x0000000074321000-0x0000000074323000-memory.dmp

Filesize
8KB

Download
memory/984-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/984-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1480-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000000000-mapping.dmp

Download
memory/1628-56-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1628-57-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1628-59-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1628-63-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1744-65-0x0000000000000000-mapping.dmp

Download