qakbot | 72a8ff9e0c9d02648c509ae7e2c176c89711ba0fe6f4df76850e8d22d278f82c

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

almond/rampart.dll
Size

490KB
MD5

4472eb5e334578d485ecda238750043a
SHA1

a1a15722fbd9efaf615fd45d3f4d451e1bdbf074
SHA256

9726d6d030678adb81295998a2b9c5eccd2523e2a155b57cf9315cf69ab0e19a
SHA512

0fda71f1358acbdb98d161302736b3af36048c1122598a804382c780f4231b2d548f29e2f7d40d7110b2171ff71d7abfb32962e69fdc0f44a917c9eb82d617f0
SSDEEP

6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TIlMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTNiwz4agFwid7e

Score

10^/10

qakbot bb07 1669024152 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB07

Campaign

1669024152

69.119.123.159:2222

197.148.17.17:2078

174.104.184.149:443

12.172.173.82:995

91.68.227.219:443

85.241.180.94:443

83.7.53.150:443

213.22.188.57:2222

71.46.234.170:443

190.75.150.58:2222

86.98.15.100:995

89.115.196.99:443

83.31.254.67:2222

46.162.109.183:443

2.84.98.228:2222

78.69.251.252:2222

12.172.173.82:465

75.143.236.149:443

47.229.96.60:443

80.121.8.212:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
956	regsvr32.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe
560	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

956 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 1496 wrote to memory of 956	1496	regsvr32.exe	regsvr32.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe
PID 956 wrote to memory of 560	956	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\almond\rampart.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\almond\rampart.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-61-0x0000000000000000-mapping.dmp

Download
memory/560-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/560-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/956-56-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/956-58-0x00000000004C0000-0x00000000004EA000-memory.dmp

Filesize
168KB

Download
memory/956-57-0x00000000004C0000-0x00000000004EA000-memory.dmp

Filesize
168KB

Download
memory/956-59-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download
memory/956-60-0x00000000004C0000-0x00000000004EA000-memory.dmp

Filesize
168KB

Download
memory/956-63-0x00000000004C0000-0x00000000004EA000-memory.dmp

Filesize
168KB

Download
memory/1496-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download