qakbot | 9d0e9183b88823f5a401ef5cc0f32fd47f7a8270073acc8ec1baf5abfe4fd104

Analysis

max time kernel
150s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

benin.dat.3.dll
Size

422KB
MD5

a2714f8819c1f7d8609f3e82b8e1d531
SHA1

dd69500de27704000dced76bafed8bcac859b6ea
SHA256

9d0e9183b88823f5a401ef5cc0f32fd47f7a8270073acc8ec1baf5abfe4fd104
SHA512

cdc2210e31fd0871f8289ae09d1666a68f26cd6719c0eec43effdc34d4873c2ce332bf68d37022e0dca4459113e06c27460244fc9250fc6d8f42777f484bfe64
SSDEEP

12288:eqdD/sblafl4M/8toGXJZ6diNj6o8Ywr6t57AKC:eqdclafl4eGXuiNp8Ye6c

Score

10^/10

qakbot bb04 1666863946 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.2

Botnet

BB04

Campaign

1666863946

27.110.134.202:995

1.156.220.47:17155

186.188.80.134:443

1.190.199.101:9480

187.1.1.181:42178

118.200.83.226:443

187.0.1.144:51727

193.3.19.137:443

1.201.68.209:12157

188.49.56.189:443

187.0.1.14:58271

190.74.248.136:443

201.210.92.3:2222

187.0.1.105:40325

64.123.103.123:443

41.97.169.44:443

72.88.245.71:443

187.0.1.45:59049

41.100.163.127:443

187.0.1.83:62527

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Extracted

Family

qakbot

Attributes

salt
�Ku��s�-�6��=RH��L�ۓZ6פQ�~�O�^-t�c8e��PA�F*��\S��a ~�)/�Ƚ�6Rju��Y�d��E�̠�E��:�w 5�� m��N��Ӿ�[V� <W1��7 Y7�Az�h�NN�}��9� �r�[�N�"��{��u9��X"�t��x�� <�-|��44�'xJζ�,�$�)3��$k-ӥi�,�n␩��趟��ÏKF �:J�e6cl-u2f�~+��ٌc�6��9��}�*��s�0d��Ι�l��D��{)a��A2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
824	regsvr32.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe
1780	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
824	regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 824 wrote to memory of 1780	824	regsvr32.exe	28
PID 824 wrote to memory of 1780	824	regsvr32.exe	28
PID 824 wrote to memory of 1780	824	regsvr32.exe	28
PID 824 wrote to memory of 1780	824	regsvr32.exe	28
PID 824 wrote to memory of 1780	824	regsvr32.exe	28
PID 824 wrote to memory of 1780	824	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/824-57-0x00000000001F0000-0x0000000000219000-memory.dmp

Filesize
164KB

Download
memory/824-58-0x00000000001F0000-0x0000000000219000-memory.dmp

Filesize
164KB

Download
memory/824-59-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/824-60-0x00000000001F0000-0x0000000000270000-memory.dmp

Filesize
512KB

Download
memory/824-61-0x00000000001F0000-0x0000000000270000-memory.dmp

Filesize
512KB

Download
memory/824-64-0x00000000001F0000-0x0000000000219000-memory.dmp

Filesize
164KB

Download
memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1780-65-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1780-66-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download