qakbot | 1e7b28d02a08d5c7268f623c1acd5c2e9b7bc4cb8195a9cd91afd69519789ee9

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

democratization/wrestle.dll
Size

806KB
MD5

665a19143949121b401c8ecdc6c5f6e2
SHA1

d2ae17106355a04defc3df935ea5ec0deae59546
SHA256

e2cf414871e798f430eb9e54ae5d955b6ada4315b3af7418d209ac887028427f
SHA512

edf5f8d874a2e42d2a453fb7dea0810226ac0d0f7ce34947e9ff4b958d3c4e4be61855dcb0a1a5a7daf9a4ffb34c2a959bad04b4ee3064f9c74b93077c2ab77f
SSDEEP

12288:+XA+Tdb0guWIUjoxRxus7grz1yqpn0CgB3gLYFvknxByn5I117KcU4Mxn:5CG5b2ofd7grzZ5093QMOQ5iM

Score

10^/10

qakbot bb 1663570298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.894

Botnet

Campaign

1663570298

70.49.33.200:2222

66.181.164.43:443

109.155.5.164:993

99.232.140.205:2222

78.100.228.93:995

64.207.215.69:443

134.35.13.201:443

86.98.156.218:993

119.82.111.158:443

193.3.19.37:443

177.255.14.99:995

68.224.229.42:443

190.44.40.48:995

187.205.222.100:443

41.97.76.61:443

41.111.77.115:995

196.64.239.93:443

100.1.5.250:995

194.166.205.204:995

88.232.207.24:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exe

pid	process
1808	rundll32.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1808 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1808	1972	rundll32.exe	rundll32.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe
PID 1808 wrote to memory of 1608	1808	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\democratization\wrestle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\democratization\wrestle.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1608

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-62-0x0000000000000000-mapping.dmp

Download
memory/1608-67-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1608-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1608-64-0x0000000074691000-0x0000000074693000-memory.dmp

Filesize
8KB

Download
memory/1808-57-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/1808-58-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/1808-60-0x00000000002D0000-0x0000000000312000-memory.dmp

Filesize
264KB

Download
memory/1808-61-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/1808-59-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-65-0x0000000000710000-0x0000000000732000-memory.dmp

Filesize
136KB

Download
memory/1808-56-0x0000000000640000-0x000000000070E000-memory.dmp

Filesize
824KB

Download
memory/1808-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download