qakbot | 9020250778de1720c3f97307f58baf9737dcf7af7969fd495e35bf97123f33a2

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

animators/participates.dll
Size

835KB
MD5

d06e0e54a6d4c8a7996f1e2619f1efdf
SHA1

d689846c783af6786748dce785a422aaeb73bb6c
SHA256

ed974b2b9e7dd9d96977e605f474f3ba8cfa4b1dbc9f12bbfabda9e06c7b39a7
SHA512

1323e002dbeffd6a8ca50b9e0f697d1a783c3fcc7315666f26ce5fd3100a4b9b575d480e6da02cfd73191e5b804c969c3e176bd16dc229561549463cf1dd9c38
SSDEEP

12288:T6F+DfZxL4+Dir8lkQ5z4hbsmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:T6F+DRt4Tr8lkBhgp2QOU

Score

10^/10

qakbot bb06 1668670510 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB06

Campaign

1668670510

86.225.214.138:2222

71.183.236.133:443

182.66.197.35:443

70.66.199.12:443

76.80.180.154:995

180.151.104.143:443

92.149.205.238:2222

83.110.223.247:443

183.87.31.34:443

105.103.50.1:990

103.141.50.117:995

105.103.50.1:465

105.103.50.1:22

86.130.9.167:2222

86.99.15.243:2222

90.104.22.28:2222

172.117.139.142:995

176.142.207.63:443

142.161.27.232:2222

71.247.10.63:50003

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
1192	regsvr32.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1192 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 1192	1796	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe
PID 1192 wrote to memory of 672	1192	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\animators\participates.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\animators\participates.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-62-0x0000000000000000-mapping.dmp

Download
memory/672-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/672-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1192-55-0x0000000000000000-mapping.dmp

Download
memory/1192-56-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1192-57-0x0000000000210000-0x000000000023A000-memory.dmp

Filesize
168KB

Download
memory/1192-58-0x0000000000210000-0x000000000023A000-memory.dmp

Filesize
168KB

Download
memory/1192-59-0x00000000001E0000-0x0000000000260000-memory.dmp

Filesize
512KB

Download
memory/1192-60-0x00000000001E0000-0x0000000000260000-memory.dmp

Filesize
512KB

Download
memory/1192-61-0x00000000001E0000-0x0000000000260000-memory.dmp

Filesize
512KB

Download
memory/1796-54-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Filesize
8KB

Download