qakbot | d127e0c805be94fef708c47ad62037ba3840d7b1db5330deea2bc40160501f45

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

D704DA175248D59C068D9251F96DEEB2.dll
Size

393KB
MD5

d704da175248d59c068d9251f96deeb2
SHA1

3c95b16e88c5edc3a7f24c0b7c78bf4312a82599
SHA256

d127e0c805be94fef708c47ad62037ba3840d7b1db5330deea2bc40160501f45
SHA512

21903bfd94beb1d7d88e3ff09e4727ac50c5f868633336173311d8033f3bbe19b01c1579cec4a7a660c9ee99aab1c8912986028ff450d3e693bc13008c835155
SSDEEP

6144:P57WEjEaG/tptUcHme85N6w0ZmXp8jwkGU99WOUN2LAOh:IEj7QPw5cwimXujH33

Score

10^/10

qakbot bb 1664437404 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

Campaign

1664437404

113.180.55.111:443

58.186.75.42:443

105.184.56.118:995

196.206.133.114:995

80.253.189.55:443

193.3.19.137:443

41.104.80.233:443

49.205.197.13:443

186.81.122.168:443

216.238.83.82:443

216.238.83.82:995

39.44.5.104:995

196.207.146.151:443

216.238.108.61:995

139.84.167.18:995

139.84.167.18:443

216.238.108.61:443

149.28.38.16:995

134.35.12.30:443

131.100.40.13:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
828	regsvr32.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe
2040	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
828	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 1324 wrote to memory of 828	1324	regsvr32.exe	27
PID 828 wrote to memory of 2040	828	regsvr32.exe	28
PID 828 wrote to memory of 2040	828	regsvr32.exe	28
PID 828 wrote to memory of 2040	828	regsvr32.exe	28
PID 828 wrote to memory of 2040	828	regsvr32.exe	28
PID 828 wrote to memory of 2040	828	regsvr32.exe	28
PID 828 wrote to memory of 2040	828	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D704DA175248D59C068D9251F96DEEB2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\D704DA175248D59C068D9251F96DEEB2.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/828-57-0x0000000000180000-0x00000000001C2000-memory.dmp

Filesize
264KB

Download
memory/828-58-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/828-61-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1324-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download
memory/2040-62-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2040-63-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download