qakbot | 8664cc0492e319baa8ef51a3233a7173cb25a7deb00af4dfd2e4b4b38a48990b

Resubmissions

26-10-2022 21:55

221026-1stprahccq 10

26-10-2022 21:52

221026-1rkepahcb5 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inexhaustive/consort.dll
Size

420KB
MD5

a6926d24cfbe649f577bb46b75627111
SHA1

aa0a014ff71263241fa42c6c2eb433eebd57ddcd
SHA256

d3ba7bfab00fc60fa37454316f0bbc978c15505d14b1eb616e4277a04411abbd
SHA512

7e1570962ba4390170de03e24937ead69754cb030115141b3e4a51284a8ff0a48ecc1287dfde7a9bfea8e06b79c881d2e6cf0c9929b60e1cba1249432ebf15ff
SSDEEP

6144:5MVSKlGqB/JXPX+cDBLrgq/6qot7FZyRxJt2gRxhYU1sNmcvVR2l2HM+LJUaoF2:OVPlBJXWcJkq/GNU1E1T5Hb1

Score

10^/10

qakbot obama217 1666765529 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
2116	regsvr32.exe
2116	regsvr32.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe
4276	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2116 regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2480 wrote to memory of 2116	2480	regsvr32.exe	regsvr32.exe
PID 2480 wrote to memory of 2116	2480	regsvr32.exe	regsvr32.exe
PID 2480 wrote to memory of 2116	2480	regsvr32.exe	regsvr32.exe
PID 2116 wrote to memory of 4276	2116	regsvr32.exe	wermgr.exe
PID 2116 wrote to memory of 4276	2116	regsvr32.exe	wermgr.exe
PID 2116 wrote to memory of 4276	2116	regsvr32.exe	wermgr.exe
PID 2116 wrote to memory of 4276	2116	regsvr32.exe	wermgr.exe
PID 2116 wrote to memory of 4276	2116	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\inexhaustive\consort.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\inexhaustive\consort.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-132-0x0000000000000000-mapping.dmp

Download
memory/2116-133-0x0000000000F40000-0x0000000000F6B000-memory.dmp

Filesize
172KB

Download
memory/2116-134-0x0000000000F70000-0x0000000000F99000-memory.dmp

Filesize
164KB

Download
memory/2116-136-0x0000000000F70000-0x0000000000F99000-memory.dmp

Filesize
164KB

Download
memory/4276-135-0x0000000000000000-mapping.dmp

Download
memory/4276-137-0x0000000000860000-0x0000000000889000-memory.dmp

Filesize
164KB

Download
memory/4276-138-0x0000000000860000-0x0000000000889000-memory.dmp

Filesize
164KB

Download