qakbot | 3abf95ab3254933b78291d3ef8abcbc122cecb5856646d26cae0b22a6c39cb63

Analysis

max time kernel
299s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YouContractChanges/Pays.cmd
Size

12KB
MD5

15c4dfd2b4c1b549dbd50b8d1a75b913
SHA1

e5cb3490d42fcd8f6f1f147d47236e6137831f54
SHA256

3214dbdee5237c936f317e2b484a769ff46e51484e9c3637269e2a9316aaef24
SHA512

1674f50edbdbae0d0f1520ef1a6bd1d827b73a02de373ec856057c80f9565e3bf8bd6f150181e3c43d9654d6a6db0fffec82f7dab73da0f3bb5b54d5b24b9ed6
SSDEEP

192:qrxipYGzl5+014gr/mqC3uGOq4wH+EypryKHBqM2ptf8uLC:qrxKYANpr/OjO+HHeGdM2ptf8uLC

Score

10^/10

qakbot azd 1671633144 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671633144

12.172.173.82:995

213.67.255.57:2222

75.143.236.149:443

86.130.9.250:2222

217.43.16.149:443

86.183.251.169:2222

67.235.138.14:443

84.35.26.14:995

90.165.109.4:2222

65.30.139.145:995

47.34.30.133:443

76.170.252.153:995

12.172.173.82:21

69.159.156.133:2222

152.170.17.136:443

82.11.242.219:443

67.61.71.201:443

73.22.121.210:443

87.65.160.87:995

73.36.196.11:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
4848	rundll32.exe
4848	rundll32.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe
5068	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4848 rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2292 wrote to memory of 2784	2292	cmd.exe	rundll32.exe
PID 2292 wrote to memory of 2784	2292	cmd.exe	rundll32.exe
PID 2784 wrote to memory of 4848	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 4848	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 4848	2784	rundll32.exe	rundll32.exe
PID 4848 wrote to memory of 5068	4848	rundll32.exe	wermgr.exe
PID 4848 wrote to memory of 5068	4848	rundll32.exe	wermgr.exe
PID 4848 wrote to memory of 5068	4848	rundll32.exe	wermgr.exe
PID 4848 wrote to memory of 5068	4848	rundll32.exe	wermgr.exe
PID 4848 wrote to memory of 5068	4848	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\YouContractChanges\Pays.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\system32\rundll32.exe
rundll32 /s newfiles.sm,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s newfiles.sm,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-132-0x0000000000000000-mapping.dmp

Download
memory/4848-133-0x0000000000000000-mapping.dmp

Download
memory/4848-134-0x0000000002B50000-0x0000000002B7A000-memory.dmp

Filesize
168KB

Download
memory/5068-139-0x0000000000000000-mapping.dmp

Download
memory/5068-140-0x0000000000BD0000-0x0000000000BFA000-memory.dmp

Filesize
168KB

Download
memory/5068-141-0x0000000000BD0000-0x0000000000BFA000-memory.dmp

Filesize
168KB

Download