qakbot | fdab7a423d2e4ce4809e254d9750351c212dfd6139fd5c05084f5df775ca1160

Resubmissions

23-12-2022 21:23

221223-z8k7wahb67 10

23-12-2022 21:19

221223-z6ex3scd5t 1

23-12-2022 21:16

221223-z4f3cscd5s 1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2022 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NewInformation.dll
Size

817KB
MD5

84914562180482324cf63211be4b02dc
SHA1

d8164220c70585a4ab0fa0815ad05a25ad33bc10
SHA256

fdab7a423d2e4ce4809e254d9750351c212dfd6139fd5c05084f5df775ca1160
SHA512

2a0f11de4b010dcae71cba63e33ea9c3ed79ad671ed28cfaf2738da9681b71f4368d99929bd61b8ef4bf19b15861507b627eaad26a348c6a766e1982f818d780
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6Nl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
4840	rundll32.exe
4840	rundll32.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe
760	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4840 rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 552 wrote to memory of 4840	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 4840	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 4840	552	rundll32.exe	rundll32.exe
PID 4840 wrote to memory of 760	4840	rundll32.exe	wermgr.exe
PID 4840 wrote to memory of 760	4840	rundll32.exe	wermgr.exe
PID 4840 wrote to memory of 760	4840	rundll32.exe	wermgr.exe
PID 4840 wrote to memory of 760	4840	rundll32.exe	wermgr.exe
PID 4840 wrote to memory of 760	4840	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation.dll,Updt
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NewInformation.dll,Updt
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-138-0x0000000000000000-mapping.dmp

Download
memory/760-139-0x0000000001050000-0x000000000107A000-memory.dmp

Filesize
168KB

Download
memory/760-140-0x0000000001050000-0x000000000107A000-memory.dmp

Filesize
168KB

Download
memory/4840-132-0x0000000000000000-mapping.dmp

Download
memory/4840-133-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download