qakbot | 75f51c1238d8064298f231d387892c58bca859ec7087fd10e6e1a0a493f6f30a

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

more/veryAs.dll
Size

484KB
MD5

124405e8f46a33ff523128b208c951d7
SHA1

6a8b07b7459e5e8ca16f659dbaa0ad4a7e055dd5
SHA256

9339df4f96d6439a812e8f080b7fe0dd6e7594ac64d66bdfc99e3b6aa1442aa9
SHA512

b1a1c329c00d2da4b67308529219c287e31a4de74319be580316a20ea73ed432198a5f5857a29cc3cecb74d7380764c1e38ecb1322671b72abf5c8def2dce1e0
SSDEEP

12288:A4/Wg5+3McbxH1yWmG2dOsG8ZoxRZ6s95r:A4j5+/xH9YQUoIs95

Score

10^/10

qakbot obama204 1663313119 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.892

Botnet

obama204

Campaign

1663313119

119.82.111.158:443

134.35.10.207:443

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

217.165.85.223:993

70.49.33.200:2222

193.3.19.37:443

41.96.56.224:443

99.232.140.205:2222

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

196.64.237.138:443

190.44.40.48:995

72.88.245.71:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1988	regsvr32.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe
956	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1988 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 1988	1980	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe
PID 1988 wrote to memory of 956	1988	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\more\veryAs.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\more\veryAs.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-60-0x0000000000000000-mapping.dmp

Download
memory/956-62-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/956-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/956-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1980-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000000000000-mapping.dmp

Download
memory/1988-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1988-57-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/1988-59-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/1988-63-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download