qakbot | ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 21:33

Target
xxviii.dat.dll
Size 696KB
Sample221003-1d62jagdgr
SHA256 ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c
MD5 3d48534dfce5e3ae8b4282a9b80d636c
SHA1 8083d6bfed227cb4b876415347d9b620a2ec617e
SHA512 f16ffe478d42cdaa649f1d63858e16bed986c2bee05aa127aba8a2c130e3672c349d23f17635c508257f21c103590582df19a79e72fad17c7b7abe467aa1d544
SSDEEP 12288:gjLgntY7WZZdud9vUsdopaJm08L+CbbDy+SsF:gHx8sd9MsdcaJm0o1bPy+SsF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1376	regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1376	932	regsvr32.exe	81
PID 932 wrote to memory of 1376	932	regsvr32.exe	81
PID 932 wrote to memory of 1376	932	regsvr32.exe	81
PID 1376 wrote to memory of 4880	1376	regsvr32.exe	82
PID 1376 wrote to memory of 4880	1376	regsvr32.exe	82
PID 1376 wrote to memory of 4880	1376	regsvr32.exe	82
PID 1376 wrote to memory of 4880	1376	regsvr32.exe	82
PID 1376 wrote to memory of 4880	1376	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xxviii.dat.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xxviii.dat.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4880

memory/1376-133-0x00000000756B0000-0x0000000075763000-memory.dmp

Download

memory/1376-134-0x0000000002050000-0x0000000002092000-memory.dmp

Download

memory/1376-135-0x0000000000850000-0x0000000000872000-memory.dmp

Download

memory/1376-137-0x00000000756B0000-0x0000000075763000-memory.dmp

Download

memory/1376-138-0x0000000000850000-0x0000000000872000-memory.dmp

Download

memory/4880-139-0x0000000000C50000-0x0000000000C72000-memory.dmp

Download

memory/4880-140-0x0000000000C50000-0x0000000000C72000-memory.dmp

Download