qakbot | 5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778

Analysis

max time kernel
153s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
publish/pebbles.dll
Size 481KB
Sample221003-snfnbscde3
SHA256 1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
MD5 d89521adaf6418e6ebe43b1a1a9d2af9
SHA1 38cac8495ef43e51cdac1cb5e85d10137b365bee
SHA512 703db1e11372070dbbabc8a96c8600f079273e4dfad4e5437a5fd4b046187cf9f24b47ad68fadaf3bcf7fb1dcad8ecf98edd299281938eb144c4c6c29d68461f
SSDEEP 12288:Y2X+B4HKFVxT5jXAcOf35HI9H5RGqdIhr54f:L5EVl5DC4HDbd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot banker stealer trojan

Malware Config

Extracted

Family

qakbot

99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1484	regsvr32.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe
1996	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1484	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 684 wrote to memory of 1484	684	regsvr32.exe	28
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29
PID 1484 wrote to memory of 1996	1484	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\pebbles.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\publish\pebbles.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1484-56-0x0000000075241000-0x0000000075243000-memory.dmp

Download

memory/1484-57-0x00000000749F0000-0x0000000074A6F000-memory.dmp

Download

memory/1484-58-0x00000000749F0000-0x0000000074A6F000-memory.dmp

Download

memory/1484-59-0x00000000001A0000-0x00000000001E2000-memory.dmp

Download

memory/1484-60-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/1484-63-0x00000000749F0000-0x0000000074A6F000-memory.dmp

Download

memory/1484-64-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/1996-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Download

memory/1996-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Download