qakbot | 0f0ee6558b84cbf678049bc076475122e93b1a0e07eef6bf1a4cd1daaf946f22

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

muuopzfn.dll
Size

421KB
MD5

c59c67fe5908c2cf67d2a7baf548d317
SHA1

799f21200be5b863b2e0111185e6b1e11ddddfbd
SHA256

0f0ee6558b84cbf678049bc076475122e93b1a0e07eef6bf1a4cd1daaf946f22
SHA512

f6c792404a3cc0f9944da792f2ac3d27052ca721192c675c2512045ed61904cc22dfc32d2d322418d6c9d90a5e7cde6c7c047b8f12a547ca84d3c341afce57df
SSDEEP

12288:Pkpde329VEdv++607q6YP4uo7N9BIegv8JowUShUPw:Pudy29ChzEopQ0Uw

Score

10^/10

qakbot bb05 1667294768 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667294768

136.232.184.134:995

65.20.175.208:443

78.161.38.242:443

154.247.31.51:993

50.68.204.71:993

154.247.31.51:995

154.247.31.51:32103

50.68.204.71:995

142.161.120.116:2222

84.35.26.14:995

174.0.224.214:443

181.164.194.228:443

58.247.115.126:995

74.92.243.113:995

74.92.243.113:50000

149.126.159.224:443

68.146.18.15:443

182.66.197.35:443

216.82.134.218:443

186.64.67.44:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
992	regsvr32.exe
992	regsvr32.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe
3592	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

992 regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4448 wrote to memory of 992	4448	regsvr32.exe	regsvr32.exe
PID 4448 wrote to memory of 992	4448	regsvr32.exe	regsvr32.exe
PID 4448 wrote to memory of 992	4448	regsvr32.exe	regsvr32.exe
PID 992 wrote to memory of 3592	992	regsvr32.exe	wermgr.exe
PID 992 wrote to memory of 3592	992	regsvr32.exe	wermgr.exe
PID 992 wrote to memory of 3592	992	regsvr32.exe	wermgr.exe
PID 992 wrote to memory of 3592	992	regsvr32.exe	wermgr.exe
PID 992 wrote to memory of 3592	992	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\muuopzfn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\muuopzfn.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-132-0x0000000000000000-mapping.dmp

Download
memory/992-133-0x0000000002CF0000-0x0000000002D1C000-memory.dmp

Filesize
176KB

Download
memory/992-134-0x0000000002D20000-0x0000000002D4A000-memory.dmp

Filesize
168KB

Download
memory/992-136-0x0000000002D20000-0x0000000002D4A000-memory.dmp

Filesize
168KB

Download
memory/3592-135-0x0000000000000000-mapping.dmp

Download
memory/3592-137-0x0000000000CE0000-0x0000000000D0A000-memory.dmp

Filesize
168KB

Download
memory/3592-138-0x0000000000CE0000-0x0000000000D0A000-memory.dmp

Filesize
168KB

Download