qakbot | 1d3ec9cc32e182fdca13de069d4e2681a053b286f0773fbd894627bff6ab70e8

Analysis

max time kernel
269s
max time network
180s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
21-11-2022 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

templates201.dll
Size

421KB
MD5

c59c67fe5908c2cf67d2a7baf548d317
SHA1

799f21200be5b863b2e0111185e6b1e11ddddfbd
SHA256

0f0ee6558b84cbf678049bc076475122e93b1a0e07eef6bf1a4cd1daaf946f22
SHA512

f6c792404a3cc0f9944da792f2ac3d27052ca721192c675c2512045ed61904cc22dfc32d2d322418d6c9d90a5e7cde6c7c047b8f12a547ca84d3c341afce57df
SSDEEP

12288:Pkpde329VEdv++607q6YP4uo7N9BIegv8JowUShUPw:Pudy29ChzEopQ0Uw

Score

10^/10

qakbot bb05 1667294768 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667294768

136.232.184.134:995

65.20.175.208:443

78.161.38.242:443

154.247.31.51:993

50.68.204.71:993

154.247.31.51:995

154.247.31.51:32103

50.68.204.71:995

142.161.120.116:2222

84.35.26.14:995

174.0.224.214:443

181.164.194.228:443

58.247.115.126:995

74.92.243.113:995

74.92.243.113:50000

149.126.159.224:443

68.146.18.15:443

182.66.197.35:443

216.82.134.218:443

186.64.67.44:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
2508	regsvr32.exe
2508	regsvr32.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe
4584	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2508 regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2432 wrote to memory of 2508	2432	regsvr32.exe	regsvr32.exe
PID 2432 wrote to memory of 2508	2432	regsvr32.exe	regsvr32.exe
PID 2432 wrote to memory of 2508	2432	regsvr32.exe	regsvr32.exe
PID 2508 wrote to memory of 4584	2508	regsvr32.exe	wermgr.exe
PID 2508 wrote to memory of 4584	2508	regsvr32.exe	wermgr.exe
PID 2508 wrote to memory of 4584	2508	regsvr32.exe	wermgr.exe
PID 2508 wrote to memory of 4584	2508	regsvr32.exe	wermgr.exe
PID 2508 wrote to memory of 4584	2508	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\templates201.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\templates201.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-115-0x0000000000000000-mapping.dmp

Download
memory/2508-116-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-117-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-118-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-119-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-120-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-121-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-122-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-123-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-124-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-125-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-126-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-127-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-128-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-129-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-130-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-131-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-132-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-133-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-134-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-136-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-135-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-137-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-138-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-139-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-140-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-141-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-142-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-143-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-144-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-145-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-146-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-147-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-148-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-149-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-150-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-151-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-152-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-153-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-154-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-155-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-156-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-157-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-158-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-160-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-159-0x0000000002E10000-0x0000000002E3C000-memory.dmp

Filesize
176KB

Download
memory/2508-162-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-161-0x0000000002E60000-0x0000000002FAA000-memory.dmp

Filesize
1.3MB

Download
memory/2508-163-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-164-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-165-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/2508-166-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-167-0x0000000000000000-mapping.dmp

Download
memory/4584-168-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-169-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-170-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-171-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-172-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-173-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-174-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-175-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-176-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-177-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-178-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-180-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-179-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-181-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-182-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/4584-224-0x0000000003280000-0x00000000032AA000-memory.dmp

Filesize
168KB

Download
memory/4584-225-0x0000000003280000-0x00000000032AA000-memory.dmp

Filesize
168KB

Download