qakbot | 75d1956af5b4954c6c6336cd898db3ea85cd7987b1786b0c4e3cd64f7be7aee4

Analysis

max time kernel
150s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YouContractChanges/YouContractChanges.cmd
Size

11KB
MD5

337f432e84107973910c7b556707fd30
SHA1

12e33fedc47350123a8ad8019198959e165acef7
SHA256

3092c8fc8a632c2d482c37743cf7b08d85f0ef0543589322320942cd6ac00044
SHA512

1c542ad24bf623f4e49beb17ae347f2a2b9b192b8b33ee8e52866ed82c3e98b04d280a27930453ec7a6146737fa94072b3064737dc0c3b671d947013d0dff364
SSDEEP

192:8iGQ9xxAH971UV1C9XsMFYKeNd0kbesN7rwBz2DvZeX2e1j93l/ZCx:8iGQ9xxAH9WV1KTYKeLfbtN7MBz4vwXg

Score

10^/10

qakbot azd 1671633144 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671633144

12.172.173.82:995

213.67.255.57:2222

75.143.236.149:443

86.130.9.250:2222

217.43.16.149:443

86.183.251.169:2222

67.235.138.14:443

84.35.26.14:995

90.165.109.4:2222

65.30.139.145:995

47.34.30.133:443

76.170.252.153:995

12.172.173.82:21

69.159.156.133:2222

152.170.17.136:443

82.11.242.219:443

67.61.71.201:443

73.22.121.210:443

87.65.160.87:995

73.36.196.11:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
3060	rundll32.exe
3060	rundll32.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe
8	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3060 rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2312 wrote to memory of 1636	2312	cmd.exe	rundll32.exe
PID 2312 wrote to memory of 1636	2312	cmd.exe	rundll32.exe
PID 1636 wrote to memory of 3060	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 3060	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 3060	1636	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 8	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 8	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 8	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 8	3060	rundll32.exe	wermgr.exe
PID 3060 wrote to memory of 8	3060	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\YouContractChanges\YouContractChanges.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\system32\rundll32.exe
rundll32 /s younewrules.local,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s younewrules.local,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-139-0x0000000000000000-mapping.dmp

Download
memory/8-140-0x0000000000350000-0x000000000037A000-memory.dmp

Filesize
168KB

Download
memory/8-141-0x0000000000350000-0x000000000037A000-memory.dmp

Filesize
168KB

Download
memory/1636-132-0x0000000000000000-mapping.dmp

Download
memory/3060-133-0x0000000000000000-mapping.dmp

Download
memory/3060-134-0x0000000000B50000-0x0000000000B7A000-memory.dmp

Filesize
168KB

Download