qakbot | 4e8d2063ddc2e5becd61280a0855e00a513fea31645d4fb361e8b799a6a04dd3

Analysis

max time kernel
211s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

templates025.dll
Size

421KB
MD5

8203065d51ae0f30ddeadbc1d6aeef34
SHA1

288f1e378ff190ac5777bfa47014bb5f7b04d736
SHA256

4e8d2063ddc2e5becd61280a0855e00a513fea31645d4fb361e8b799a6a04dd3
SHA512

3fe2a844c87593b251dcd90fe2f32ebb14fa8f7aed4ad34632d07b94e2c35f4ad7836a506b7a2294844b4246a804d87283c6cd59b1550510f82296f66bd25671
SSDEEP

12288:Pkpde329VEdv++607q6YP4uo7N9cIegv8JowUShUPw:Pudy29ChzEoEQ0Uw

Score

10^/10

qakbot bb05 1667294768 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667294768

136.232.184.134:995

65.20.175.208:443

78.161.38.242:443

154.247.31.51:993

50.68.204.71:993

154.247.31.51:995

154.247.31.51:32103

50.68.204.71:995

142.161.120.116:2222

84.35.26.14:995

174.0.224.214:443

181.164.194.228:443

58.247.115.126:995

74.92.243.113:995

74.92.243.113:50000

149.126.159.224:443

68.146.18.15:443

182.66.197.35:443

216.82.134.218:443

186.64.67.44:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
1668	regsvr32.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe
972	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1668 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 1668	1000	regsvr32.exe	regsvr32.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe
PID 1668 wrote to memory of 972	1668	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\templates025.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\templates025.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-61-0x0000000000000000-mapping.dmp

Download
memory/972-63-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/972-64-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1000-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x0000000000000000-mapping.dmp

Download
memory/1668-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1668-58-0x00000000002F0000-0x000000000031A000-memory.dmp

Filesize
168KB

Download
memory/1668-57-0x00000000002F0000-0x000000000031A000-memory.dmp

Filesize
168KB

Download
memory/1668-59-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/1668-60-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download