qakbot | b0e9cc8b694fe777386ad45946a5da490da5eb8788cc0429ed952a29048b7b54

Analysis

max time kernel
150s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unnautical/unbundles.dll
Size

497KB
MD5

2e616a399fabd662ff46730205ac2980
SHA1

57d192ebd7b733d65e4db5b746f8fc2c31e28d60
SHA256

4362a0d07d499afc6a2f948b64a4800684dbddb3b76464b78860f6f6a77640a3
SHA512

fb31b3bd4b92070b4f9ea9901c77c908962bc16dea4c392ece9313fc918c60d6aef8c9991b893d8794bda2cc10ebc82e139cd5fb69eee4df806e256301b2a879
SSDEEP

6144:kc0+H0LwX/ei0iPlJgQwggr6cAhMtnEbER8wvyRaY4Kls1yc8UQw8Mz1fu:D06cilJy9tnY+yTbm8UQw8Mzxu

Score

10^/10

qakbot bb09 1670238005 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

BB09

Campaign

1670238005

76.100.159.250:443

66.191.69.18:995

186.64.67.9:443

50.90.249.161:443

109.150.179.158:2222

92.149.205.238:2222

86.165.15.180:2222

41.44.19.36:995

78.17.157.5:443

173.18.126.3:443

75.99.125.235:2222

172.90.139.138:2222

27.99.45.237:2222

91.68.227.219:443

12.172.173.82:993

103.144.201.62:2078

12.172.173.82:990

173.239.94.212:443

91.169.12.198:32100

24.64.114.59:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1652	rundll32.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe
700	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1652 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 1652	1268	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe
PID 1652 wrote to memory of 700	1652	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unnautical\unbundles.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unnautical\unbundles.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-58-0x0000000000000000-mapping.dmp

Download
memory/700-61-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/700-62-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1652-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1652-56-0x00000000005C0000-0x0000000000633000-memory.dmp

Filesize
460KB

Download
memory/1652-57-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/1652-60-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download