qakbot | a3ac51fa56c06fc9f5fb24ea4eee4fb76e01a9ad30b0748dbe2ffe706db52311

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

judicature/mucked.dll
Size

1.6MB
MD5

b9aed833999244d4861a6cc232de3fe5
SHA1

bb88cf8ac22a5feb01fb3f1d448c3dbf9b09b611
SHA256

63959c0cd8d14b1e6b589378d25fd9ed285cd108487ff645ea0b62eae7c14899
SHA512

de8e5a10e04e9555be8cace59e42f1a09ea3d9cb8e259794e09861d605d9050b01552823e256eb5be8b602495ed689817757b8c6e8ae41aeb00596ab62bb66c8
SSDEEP

24576:hdOBKJGDcYOGm+FpvC04Rl3ZC499TlgxE29S3G8Ok8YdSkQh:hs9dm+n60YZCZY3tR8Ydkh

Score

10^/10

qakbot bb05 1667208557 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

BB05

Campaign

1667208557

174.77.209.5:443

187.0.1.74:23795

24.206.27.39:443

1.156.220.169:30723

156.216.39.119:995

58.186.75.42:443

1.156.197.160:30467

187.1.1.190:4844

186.18.210.16:443

1.181.56.171:771

90.165.109.4:2222

187.0.1.186:39742

87.57.13.215:443

187.0.1.207:52344

227.26.3.227:1

98.207.190.55:443

187.0.1.197:7017

188.49.56.189:443

102.156.160.115:443

187.0.1.24:17751

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	rundll32.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe
948	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2012	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 1800 wrote to memory of 2012	1800	rundll32.exe	28
PID 2012 wrote to memory of 948	2012	rundll32.exe	29
PID 2012 wrote to memory of 948	2012	rundll32.exe	29
PID 2012 wrote to memory of 948	2012	rundll32.exe	29
PID 2012 wrote to memory of 948	2012	rundll32.exe	29
PID 2012 wrote to memory of 948	2012	rundll32.exe	29
PID 2012 wrote to memory of 948	2012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\mucked.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\mucked.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/948-66-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2012-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x00000000009B0000-0x0000000000B41000-memory.dmp

Filesize
1.6MB

Download
memory/2012-57-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/2012-58-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/2012-59-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/2012-60-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/2012-61-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/2012-64-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download