qakbot | fdab7a423d2e4ce4809e254d9750351c212dfd6139fd5c05084f5df775ca1160

Resubmissions

23-12-2022 21:23

221223-z8k7wahb67 10

23-12-2022 21:19

221223-z6ex3scd5t 1

23-12-2022 21:16

221223-z4f3cscd5s 1

Analysis

max time kernel
149s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-12-2022 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NewInformation.dll
Size

817KB
MD5

84914562180482324cf63211be4b02dc
SHA1

d8164220c70585a4ab0fa0815ad05a25ad33bc10
SHA256

fdab7a423d2e4ce4809e254d9750351c212dfd6139fd5c05084f5df775ca1160
SHA512

2a0f11de4b010dcae71cba63e33ea9c3ed79ad671ed28cfaf2738da9681b71f4368d99929bd61b8ef4bf19b15861507b627eaad26a348c6a766e1982f818d780
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Nl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1492	rundll32.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe
988	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1492 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1492	968	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe
PID 1492 wrote to memory of 988	1492	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation.dll,Updt
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation.dll,Updt
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-61-0x0000000000000000-mapping.dmp

Download
memory/988-63-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/988-64-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/1492-54-0x0000000000000000-mapping.dmp

Download
memory/1492-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download