qakbot | e8871e0e2d64c2a2cda27d505e489cd85537c1d4a9359ba36b3b2d129e718377

Analysis

max time kernel
150s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

breezily/registered.dll
Size

849KB
MD5

e22a4ef15b7c6c9eb884e445cefa2ef9
SHA1

b9da48940ae7e41de7bc6c0909ab53465d05e3c7
SHA256

5e5c55c133d644de044f5bcb782b618fd188a1c6ca707298815ab23295fb43c1
SHA512

3cc653b343d7f972d823e42bda4150c0747f81617b4f795e2724dfa4f0f0f10756fc068feaeedeb69ef7b4bdcd931908c5cfb0f1e8a170925915a771ff1738f8
SSDEEP

12288:VByskGoWHwa0nZXKlhb/H9TT+iTojfQCA3kptT68JtQrB5UT+QD1lNMABa:SnEjYNAeh4X668JA5w9Mqa

Score

10^/10

qakbot bb 1663698873 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

Campaign

1663698873

173.218.180.91:443

134.35.13.43:443

197.94.84.128:443

70.51.132.197:2222

181.118.183.123:443

189.19.189.222:32101

41.111.1.60:995

70.49.33.200:2222

99.232.140.205:2222

139.228.33.176:2222

193.3.19.37:443

41.99.57.155:443

177.255.14.99:995

31.54.39.153:2078

191.97.234.238:995

105.159.30.48:443

217.165.146.41:993

119.82.111.158:443

66.181.164.43:443

88.245.168.200:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1112	rundll32.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe
2028	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1112 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe
PID 1112 wrote to memory of 2028	1112	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\breezily\registered.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\breezily\registered.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000001D50000-0x0000000001E2A000-memory.dmp

Filesize
872KB

Download
memory/1112-57-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download
memory/1112-59-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download
memory/1112-58-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download
memory/1112-60-0x0000000000760000-0x00000000007A1000-memory.dmp

Filesize
260KB

Download
memory/1112-61-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download
memory/1112-64-0x00000000007B0000-0x00000000007D2000-memory.dmp

Filesize
136KB

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download
memory/2028-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2028-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download