qakbot | 9d0e9183b88823f5a401ef5cc0f32fd47f7a8270073acc8ec1baf5abfe4fd104

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

benin.dat.3.dll
Size

422KB
MD5

a2714f8819c1f7d8609f3e82b8e1d531
SHA1

dd69500de27704000dced76bafed8bcac859b6ea
SHA256

9d0e9183b88823f5a401ef5cc0f32fd47f7a8270073acc8ec1baf5abfe4fd104
SHA512

cdc2210e31fd0871f8289ae09d1666a68f26cd6719c0eec43effdc34d4873c2ce332bf68d37022e0dca4459113e06c27460244fc9250fc6d8f42777f484bfe64
SSDEEP

12288:eqdD/sblafl4M/8toGXJZ6diNj6o8Ywr6t57AKC:eqdclafl4eGXuiNp8Ye6c

Score

10^/10

qakbot bb04 1666863946 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.2

Botnet

BB04

Campaign

1666863946

27.110.134.202:995

1.156.220.47:17155

186.188.80.134:443

1.190.199.101:9480

187.1.1.181:42178

118.200.83.226:443

187.0.1.144:51727

193.3.19.137:443

1.201.68.209:12157

188.49.56.189:443

187.0.1.14:58271

190.74.248.136:443

201.210.92.3:2222

187.0.1.105:40325

64.123.103.123:443

41.97.169.44:443

72.88.245.71:443

187.0.1.45:59049

41.100.163.127:443

187.0.1.83:62527

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4812	regsvr32.exe
4812	regsvr32.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4812	regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4812	4928	regsvr32.exe	82
PID 4928 wrote to memory of 4812	4928	regsvr32.exe	82
PID 4928 wrote to memory of 4812	4928	regsvr32.exe	82
PID 4812 wrote to memory of 1484	4812	regsvr32.exe	83
PID 4812 wrote to memory of 1484	4812	regsvr32.exe	83
PID 4812 wrote to memory of 1484	4812	regsvr32.exe	83
PID 4812 wrote to memory of 1484	4812	regsvr32.exe	83
PID 4812 wrote to memory of 1484	4812	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\benin.dat.3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-137-0x00000000008D0000-0x00000000008F9000-memory.dmp

Filesize
164KB

Download
memory/1484-138-0x00000000008D0000-0x00000000008F9000-memory.dmp

Filesize
164KB

Download
memory/4812-133-0x00000000014F0000-0x000000000151B000-memory.dmp

Filesize
172KB

Download
memory/4812-134-0x0000000001520000-0x0000000001549000-memory.dmp

Filesize
164KB

Download
memory/4812-136-0x0000000001520000-0x0000000001549000-memory.dmp

Filesize
164KB

Download