qakbot | 4e8d2063ddc2e5becd61280a0855e00a513fea31645d4fb361e8b799a6a04dd3

Analysis

max time kernel
151s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

templates025.dll
Size

421KB
MD5

8203065d51ae0f30ddeadbc1d6aeef34
SHA1

288f1e378ff190ac5777bfa47014bb5f7b04d736
SHA256

4e8d2063ddc2e5becd61280a0855e00a513fea31645d4fb361e8b799a6a04dd3
SHA512

3fe2a844c87593b251dcd90fe2f32ebb14fa8f7aed4ad34632d07b94e2c35f4ad7836a506b7a2294844b4246a804d87283c6cd59b1550510f82296f66bd25671
SSDEEP

12288:Pkpde329VEdv++607q6YP4uo7N9cIegv8JowUShUPw:Pudy29ChzEoEQ0Uw

Score

10^/10

qakbot bb05 1667294768 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667294768

136.232.184.134:995

65.20.175.208:443

78.161.38.242:443

154.247.31.51:993

50.68.204.71:993

154.247.31.51:995

154.247.31.51:32103

50.68.204.71:995

142.161.120.116:2222

84.35.26.14:995

174.0.224.214:443

181.164.194.228:443

58.247.115.126:995

74.92.243.113:995

74.92.243.113:50000

149.126.159.224:443

68.146.18.15:443

182.66.197.35:443

216.82.134.218:443

186.64.67.44:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exewermgr.exe

pid	process
2080	regsvr32.exe
2080	regsvr32.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe
992	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2080 regsvr32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4804 wrote to memory of 2080	4804	regsvr32.exe	regsvr32.exe
PID 4804 wrote to memory of 2080	4804	regsvr32.exe	regsvr32.exe
PID 4804 wrote to memory of 2080	4804	regsvr32.exe	regsvr32.exe
PID 2080 wrote to memory of 992	2080	regsvr32.exe	wermgr.exe
PID 2080 wrote to memory of 992	2080	regsvr32.exe	wermgr.exe
PID 2080 wrote to memory of 992	2080	regsvr32.exe	wermgr.exe
PID 2080 wrote to memory of 992	2080	regsvr32.exe	wermgr.exe
PID 2080 wrote to memory of 992	2080	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\templates025.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\templates025.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-136-0x0000000000000000-mapping.dmp

Download
memory/992-138-0x00000000003A0000-0x00000000003CA000-memory.dmp

Filesize
168KB

Download
memory/992-139-0x00000000003A0000-0x00000000003CA000-memory.dmp

Filesize
168KB

Download
memory/2080-132-0x0000000000000000-mapping.dmp

Download
memory/2080-133-0x0000000001280000-0x00000000012AC000-memory.dmp

Filesize
176KB

Download
memory/2080-134-0x0000000001490000-0x00000000014BA000-memory.dmp

Filesize
168KB

Download
memory/2080-135-0x0000000001490000-0x00000000014BA000-memory.dmp

Filesize
168KB

Download
memory/2080-137-0x0000000001490000-0x00000000014BA000-memory.dmp

Filesize
168KB

Download