qakbot | 8cda8ebfb06a8df26692325d553f7218d98633d97e6fe9b09c9913281aa06e54

Analysis

max time kernel
152s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice/YouContract.cmd
Size

13KB
MD5

4a6a5a61db9be8261f765fcf0013f73d
SHA1

ba831e80be933606fbe14317e4ebb1fc344d48ec
SHA256

e2bc1dd0dc157ffc040eabee71dc8e9fa778428909dff1c015f7ce397048e9ad
SHA512

c6d18b842de597d4b9b290a08b288541bc314384e65a153ceb0a206812abba267e9dc03e2d1df5ef4b311171fd4c8a40800c4be479bb2d08c10c4670b2af2cc1
SSDEEP

192:EPr0f0mki8y10EeRsJOMJ9rCDQmZL2OScaLzuJBeBGG+cMh:i/i01WOi9rCXZ6FRaJBeBGG+P

Score

10^/10

qakbot azd 1671633144 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671633144

12.172.173.82:995

213.67.255.57:2222

75.143.236.149:443

86.130.9.250:2222

217.43.16.149:443

86.183.251.169:2222

67.235.138.14:443

84.35.26.14:995

90.165.109.4:2222

65.30.139.145:995

47.34.30.133:443

76.170.252.153:995

12.172.173.82:21

69.159.156.133:2222

152.170.17.136:443

82.11.242.219:443

67.61.71.201:443

73.22.121.210:443

87.65.160.87:995

73.36.196.11:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
2020	rundll32.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe
984	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2020 rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1956	1612	cmd.exe	rundll32.exe
PID 1612 wrote to memory of 1956	1612	cmd.exe	rundll32.exe
PID 1612 wrote to memory of 1956	1612	cmd.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 2020	1956	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe
PID 2020 wrote to memory of 984	2020	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Invoice\YouContract.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\rundll32.exe
rundll32 /s contract.sm,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s contract.sm,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-62-0x0000000000000000-mapping.dmp

Download
memory/984-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/984-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/2020-55-0x0000000000000000-mapping.dmp

Download
memory/2020-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/2020-57-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download