qakbot | 0a6fed37f54e149b09fdee1852b68b82c301e7397199e9f5298fc6e22f71ad72

Analysis

max time kernel
149s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmpjk_10m61.dll
Size

621KB
MD5

94f2193d53fdb77fdf85bb638abfb34d
SHA1

19927996ec7e440d54eff215cfe207b8c804e4b6
SHA256

0a6fed37f54e149b09fdee1852b68b82c301e7397199e9f5298fc6e22f71ad72
SHA512

bf0c6b8a11b422b241d3c7231ccbd84435bcaafddc5553598a111f527a0aaff150f995769cbd97ccd19b896f854c2152e083aadd7601456edb05f0ff5e14c762
SSDEEP

12288:+Wd5j2OjX3bnp68y92ckM2MLt0tcETKvnp1Rau4Vvqs9sjW:+W5jHr7cV2xTOpkVvxo

Score

10^/10

qakbot bb06 1668492308 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.27

Botnet

BB06

Campaign

1668492308

49.175.72.56:443

81.229.117.95:2222

47.41.154.250:443

69.133.162.35:443

84.35.26.14:995

68.47.128.161:443

156.217.219.147:995

87.65.160.87:995

174.101.111.4:443

82.127.174.33:2222

91.169.12.198:32100

24.28.121.122:443

157.231.42.190:995

90.89.95.158:2222

74.33.84.227:443

24.64.114.59:2222

80.13.179.151:2222

64.207.237.118:443

24.206.27.39:443

170.253.25.35:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
1228	regsvr32.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe
2016	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1228 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 1228	1784	regsvr32.exe	regsvr32.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe
PID 1228 wrote to memory of 2016	1228	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmpjk_10m61.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\tmpjk_10m61.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-55-0x0000000000000000-mapping.dmp

Download
memory/1228-56-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1228-57-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/1228-58-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/1228-59-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/1228-60-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/1228-63-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/1784-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/2016-61-0x0000000000000000-mapping.dmp

Download
memory/2016-64-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/2016-65-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download