qakbot | a4fd38b0fb8d33ef0a7ea5a46f26675a641ed5b00bd75be3dd37bf284b48d160

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-12-2022 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PayInfo/Information.cmd
Size

13KB
MD5

c44ecba2bc10e4cc60ae4ba748bce214
SHA1

656d256b4a7ca425f46c96dab218ad218191e1a1
SHA256

c4466c04ad70d14a2bb8ac660d0328b26bf67dd7af28eb94340da3d951891a16
SHA512

9b0358ef432128f83512bee5569520b66ed843d244823e1dddfb80f52436711606c9e80f4ae5c90767f1f58c1eb7973dbfae0ff2b2bf878e1eb7365b81a3edfd
SSDEEP

192:c0I0r0h0AHz0tqNdiQbQQPQwCe2AMo4Zdi3wWflt8vusNAgi/+foxx:iT0tSddPQwCe2AGZd+tougi/+foH

Score

10^/10

qakbot azd 1671633144 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671633144

12.172.173.82:995

213.67.255.57:2222

75.143.236.149:443

86.130.9.250:2222

217.43.16.149:443

86.183.251.169:2222

67.235.138.14:443

84.35.26.14:995

90.165.109.4:2222

65.30.139.145:995

47.34.30.133:443

76.170.252.153:995

12.172.173.82:21

69.159.156.133:2222

152.170.17.136:443

82.11.242.219:443

67.61.71.201:443

73.22.121.210:443

87.65.160.87:995

73.36.196.11:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1952	rundll32.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe
872	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1952 rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 952	2008	cmd.exe	rundll32.exe
PID 2008 wrote to memory of 952	2008	cmd.exe	rundll32.exe
PID 2008 wrote to memory of 952	2008	cmd.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1952	952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe
PID 1952 wrote to memory of 872	1952	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PayInfo\Information.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\rundll32.exe
rundll32 /s youcontractchanges.br,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s youcontractchanges.br,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:872

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-62-0x0000000000000000-mapping.dmp

Download
memory/872-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/872-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/1952-55-0x0000000000000000-mapping.dmp

Download
memory/1952-56-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1952-57-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download