qakbot | 1d9ccaade14075591b76fa1779ea19ed9a378fd1bcb5f0e0030761755d81192d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeedChanges/NewInformation.cmd
Size

9KB
MD5

51d15aa59519d546c709f8b60cb0cd14
SHA1

47375d5daa6848c38617b880b919f9273dfa4459
SHA256

089d7b9ce434d27da32995879eaa12a92a89df80902f5eb00606b0129eb0603d
SHA512

54d15cbb917be0884513a70a06580601d16d15d97f7c944b55a6725236787a8923358344534998a441500c50782a76b749c8595552894d8865b0c83a80fe5bd1
SSDEEP

192:eoYKmY2//ahtCitGY1t7z8HCX3iWPDR2rtFRA3Om61TmbX2mL1IuDolfSwxZPbq:/Lxb1t7ziCff76zLW

Score

10^/10

qakbot azd 1670585059 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

azd

Campaign

1670585059

173.239.94.212:443

91.169.12.198:32100

74.66.134.24:443

66.191.69.18:995

182.75.189.42:995

78.69.251.252:2222

98.145.23.67:443

103.71.21.107:443

197.94.219.133:443

91.68.227.219:443

12.172.173.82:993

86.176.83.127:2222

64.121.161.102:443

41.98.21.114:443

92.154.17.149:2222

151.65.67.211:443

89.129.109.27:2222

76.11.14.249:443

69.119.123.159:2222

70.66.199.12:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
4896	rundll32.exe
4896	rundll32.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe
3796	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4896 rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1488 wrote to memory of 2560	1488	cmd.exe	rundll32.exe
PID 1488 wrote to memory of 2560	1488	cmd.exe	rundll32.exe
PID 2560 wrote to memory of 4896	2560	rundll32.exe	rundll32.exe
PID 2560 wrote to memory of 4896	2560	rundll32.exe	rundll32.exe
PID 2560 wrote to memory of 4896	2560	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 3796	4896	rundll32.exe	wermgr.exe
PID 4896 wrote to memory of 3796	4896	rundll32.exe	wermgr.exe
PID 4896 wrote to memory of 3796	4896	rundll32.exe	wermgr.exe
PID 4896 wrote to memory of 3796	4896	rundll32.exe	wermgr.exe
PID 4896 wrote to memory of 3796	4896	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NeedChanges\NewInformation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\system32\rundll32.exe
rundll32 /s lastinformation.find,DrawThemeIcon
2⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s lastinformation.find,DrawThemeIcon
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-132-0x0000000000000000-mapping.dmp

Download
memory/3796-136-0x0000000000000000-mapping.dmp

Download
memory/3796-138-0x0000000000ED0000-0x0000000000EFA000-memory.dmp

Filesize
168KB

Download
memory/3796-139-0x0000000000ED0000-0x0000000000EFA000-memory.dmp

Filesize
168KB

Download
memory/4896-133-0x0000000000000000-mapping.dmp

Download
memory/4896-134-0x00000000017F0000-0x000000000181A000-memory.dmp

Filesize
168KB

Download
memory/4896-135-0x00000000031A0000-0x00000000031CA000-memory.dmp

Filesize
168KB

Download
memory/4896-137-0x00000000031A0000-0x00000000031CA000-memory.dmp

Filesize
168KB

Download