qakbot | 99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2_qakbot.dll
Size

230KB
MD5

6d5348e093b99e3c50b32a2af135cca6
SHA1

f87edb62046f84f8efb9f54b738850fc538c8f4c
SHA256

99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993
SHA512

5b9198e6f6780cb67167da8d013f353f38e596664b58d239e155178b37355aea68b0c1416c15d50184c2216a72521c360545de61c71e6631b983f2478a00d183
SSDEEP

6144:fHaya8NiG4uCak/IFz2TBkjXaqJDf2tIKw:/ra8oOCCt2TOjXaSDQIz

Score

10^/10

qakbot clinton16 1620911967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton16

Campaign

1620911967

71.41.184.10:3389

216.201.162.158:443

95.77.223.148:443

71.74.12.34:443

86.220.62.251:2222

24.229.150.54:995

24.55.112.61:443

76.25.142.196:443

136.232.34.70:443

149.28.99.97:443

45.63.107.192:2222

45.63.107.192:443

149.28.99.97:2222

149.28.99.97:995

45.63.107.192:995

86.248.16.253:2222

86.160.137.225:443

75.67.192.125:443

140.82.49.12:443

47.22.148.6:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

280 956 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

956 regsvr32.exe

pid	pid_target	process	target process
280	956	WerFault.exe	regsvr32.exe

pid	process
956	regsvr32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 960 wrote to memory of 956	960	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 912	956	regsvr32.exe	explorer.exe
PID 956 wrote to memory of 912	956	regsvr32.exe	explorer.exe
PID 956 wrote to memory of 912	956	regsvr32.exe	explorer.exe
PID 956 wrote to memory of 912	956	regsvr32.exe	explorer.exe
PID 956 wrote to memory of 280	956	regsvr32.exe	WerFault.exe
PID 956 wrote to memory of 280	956	regsvr32.exe	WerFault.exe
PID 956 wrote to memory of 280	956	regsvr32.exe	WerFault.exe
PID 956 wrote to memory of 280	956	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2_qakbot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2_qakbot.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 428
3⤵
- Program crash
PID:280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-58-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/956-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/956-57-0x0000000000200000-0x000000000023D000-memory.dmp

Filesize
244KB

Download
memory/960-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download