qakbot | cd35b4fffe82c7e263a990b8aaaaadfdbcc804241661fdfb05fafb9013f5ac9a

Analysis

max time kernel
152s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

publish/respiring.dll
Size

537KB
MD5

c519f8bd60844e7ea776e67a4b724e53
SHA1

c699b16ce036b50997a52114280a080d16bf5599
SHA256

e91f4205e8fa14ac9acd4b6cf9a54e2fa8b3901e619e18b3fa22188ef1ddeaff
SHA512

f28385fd7284a7395565150990ed068c143011cccc7944f0097531503a8bc62c6386299f92bd8093ed384eaec5ce327e8c75534073bf03c8f78f5bfc40dd5ca9
SSDEEP

12288:P9hOiDHnsfkmEsrq1ZBr0fvpdgJvLrG3q8/UxPVN:lPT1HsuPr+hdIO3kVN

Score

10^/10

qakbot banker stealer trojan

Malware Config

Extracted

Family

qakbot

162.224.55.111:30915

17.105.54.14:63284

149.253.253.235:19955

148.219.182.10:5489

56.214.171.2:7637

171.182.161.115:60821

175.2.110.61:49611

99.130.91.79:29604

136.197.36.254:0

99.221.33.122:35602

29.202.180.222:51620

23.94.40.182:4331

34.19.16.166:1288

241.163.135.223:50051

32.107.156.85:19172

228.49.142.11:64889

196.202.140.31:7400

110.114.87.194:23019

217.188.119.28:9613

29.44.169.79:27952

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
872	regsvr32.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe
1488	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
872	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 1016 wrote to memory of 872	1016	regsvr32.exe	28
PID 872 wrote to memory of 1488	872	regsvr32.exe	29
PID 872 wrote to memory of 1488	872	regsvr32.exe	29
PID 872 wrote to memory of 1488	872	regsvr32.exe	29
PID 872 wrote to memory of 1488	872	regsvr32.exe	29
PID 872 wrote to memory of 1488	872	regsvr32.exe	29
PID 872 wrote to memory of 1488	872	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\publish\respiring.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\publish\respiring.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/872-57-0x0000000074820000-0x00000000748AD000-memory.dmp

Filesize
564KB

Download
memory/872-58-0x0000000074820000-0x00000000748AD000-memory.dmp

Filesize
564KB

Download
memory/872-59-0x0000000000190000-0x00000000001D2000-memory.dmp

Filesize
264KB

Download
memory/872-60-0x0000000000210000-0x0000000000232000-memory.dmp

Filesize
136KB

Download
memory/872-63-0x0000000074820000-0x00000000748AD000-memory.dmp

Filesize
564KB

Download
memory/872-64-0x0000000000210000-0x0000000000232000-memory.dmp

Filesize
136KB

Download
memory/1016-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1488-65-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1488-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download