qakbot | 5ffd1c2cf286a7cc5d1914e6ccf8d8b5b5a65c5a7fc2af9af54106ca5a09918e

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

carcasses/unextradited.dll
Size

561KB
MD5

c0a85dc1b26d37e9811a9c29595d2a6d
SHA1

6c742e64f6ce3533143a453eb67f714a33a41e5c
SHA256

78ea0528d1ffe2591a69bb0a637fc234096fa29b55652c2490c571a845fa8801
SHA512

7ad5653ef71a096b2ff568868514d2f176851dea551b5b0341ba090a15caf919dc75a89f2488c720ee82e1815c3139c369e953ea28b467d6e69b4d39a8069842
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXWAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIpv9PmgfKP1KJq

Score

10^/10

qakbot bb03 1666073717 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.973

Botnet

BB03

Campaign

1666073717

190.199.99.171:993

41.69.192.245:443

167.58.254.85:443

206.1.172.1:443

5.163.177.234:443

134.35.0.103:443

105.96.221.136:443

41.101.100.7:443

186.177.93.18:2222

78.179.135.247:443

177.205.74.14:2222

102.47.218.41:443

102.156.149.226:443

41.250.48.206:443

41.107.58.251:443

187.198.16.39:443

193.201.187.64:443

41.102.134.89:443

102.159.77.134:995

105.159.49.123:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	regsvr32.exe
4480	regsvr32.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4480	regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4480	3124	regsvr32.exe	82
PID 3124 wrote to memory of 4480	3124	regsvr32.exe	82
PID 3124 wrote to memory of 4480	3124	regsvr32.exe	82
PID 4480 wrote to memory of 3904	4480	regsvr32.exe	90
PID 4480 wrote to memory of 3904	4480	regsvr32.exe	90
PID 4480 wrote to memory of 3904	4480	regsvr32.exe	90
PID 4480 wrote to memory of 3904	4480	regsvr32.exe	90
PID 4480 wrote to memory of 3904	4480	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\unextradited.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\unextradited.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-140-0x00000000010A0000-0x00000000010C9000-memory.dmp

Filesize
164KB

Download
memory/3904-141-0x00000000010A0000-0x00000000010C9000-memory.dmp

Filesize
164KB

Download
memory/4480-133-0x0000000074D30000-0x0000000074DC0000-memory.dmp

Filesize
576KB

Download
memory/4480-134-0x0000000074D30000-0x0000000074DC0000-memory.dmp

Filesize
576KB

Download
memory/4480-135-0x0000000002570000-0x00000000025E1000-memory.dmp

Filesize
452KB

Download
memory/4480-136-0x0000000002620000-0x0000000002649000-memory.dmp

Filesize
164KB

Download
memory/4480-138-0x0000000074D30000-0x0000000074DC0000-memory.dmp

Filesize
576KB

Download
memory/4480-139-0x0000000002620000-0x0000000002649000-memory.dmp

Filesize
164KB

Download