qakbot | 8ca7ba1b10daf688733dde8ae03a48a19e0bd786cee63fbfd63b4cbe0edcb21d

Analysis

max time kernel
152s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

judicature/contaminative.dll
Size

1.6MB
MD5

7e7bdad13f25974c9bd07b0591d2773e
SHA1

fd0d969841ec7654b1b969d8c296031c3575d63c
SHA256

e9e65452644cf71bddbd3a324c171117c3df219a642bca6083ee6796dc5365c2
SHA512

a7f3e3e0c8c3d07993694a30e7853d81ae97417d17ec93287cd9a5da30a305dbfad5a79b5431d599581ba05aa8d0b0b58dea88a61b20031294aaa32ee9038a82
SSDEEP

24576:hdOBKJGDcYOGm+FpvC04Rl3ZC499TlgxE29S3GrOk8YdSkQh:hs9dm+n60YZCZY3+R8Ydkh

Score

10^/10

qakbot bb05 1667208557 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

BB05

Campaign

1667208557

174.77.209.5:443

187.0.1.74:23795

24.206.27.39:443

1.156.220.169:30723

156.216.39.119:995

58.186.75.42:443

1.156.197.160:30467

187.1.1.190:4844

186.18.210.16:443

1.181.56.171:771

90.165.109.4:2222

187.0.1.186:39742

87.57.13.215:443

187.0.1.207:52344

227.26.3.227:1

98.207.190.55:443

187.0.1.197:7017

188.49.56.189:443

102.156.160.115:443

187.0.1.24:17751

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1308	rundll32.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe
1232	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1308	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 2016 wrote to memory of 1308	2016	rundll32.exe	27
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28
PID 1308 wrote to memory of 1232	1308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\contaminative.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\contaminative.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1232-66-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1308-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1308-56-0x0000000001DE0000-0x0000000001F71000-memory.dmp

Filesize
1.6MB

Download
memory/1308-57-0x0000000000920000-0x000000000094A000-memory.dmp

Filesize
168KB

Download
memory/1308-58-0x0000000000920000-0x000000000094A000-memory.dmp

Filesize
168KB

Download
memory/1308-59-0x0000000000920000-0x000000000094A000-memory.dmp

Filesize
168KB

Download
memory/1308-60-0x00000000006D0000-0x00000000006FA000-memory.dmp

Filesize
168KB

Download
memory/1308-61-0x0000000000920000-0x000000000094A000-memory.dmp

Filesize
168KB

Download
memory/1308-64-0x0000000000920000-0x000000000094A000-memory.dmp

Filesize
168KB

Download