qakbot | c8324f0f183e33a6dde4923a5dfd945261aca1eb5dc092713475bb3d02533381

Analysis

max time kernel
49s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/12/2022, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5843f7b5973ea73282fcdf0685d89dd298f03de35fc3da702f54dd4bd164cd8c.dll
Size

442KB
MD5

ae304d121a2402e36219e5c8f830b57c
SHA1

3d3379b74d2af2506e7d1ea1f8f5b71fb242ddeb
SHA256

5843f7b5973ea73282fcdf0685d89dd298f03de35fc3da702f54dd4bd164cd8c
SHA512

e548eff98ed43fba43aa7cbba0d32298b6879d36b007e50c6030c87f7c28ea119e005346625a6eb0e110440f191f202a0b223734dbfa1a22bb955cf9387b0c58
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663148750

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
576	584	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1696	regsvr32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1696	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	27
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 1696 wrote to memory of 584	1696	regsvr32.exe	28
PID 584 wrote to memory of 576	584	explorer.exe	29
PID 584 wrote to memory of 576	584	explorer.exe	29
PID 584 wrote to memory of 576	584	explorer.exe	29
PID 584 wrote to memory of 576	584	explorer.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5843f7b5973ea73282fcdf0685d89dd298f03de35fc3da702f54dd4bd164cd8c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5843f7b5973ea73282fcdf0685d89dd298f03de35fc3da702f54dd4bd164cd8c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 404
      4⤵
      Program crash
      PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-62-0x0000000073FD1000-0x0000000073FD3000-memory.dmp

Filesize
8KB

Download
memory/584-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/584-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1368-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1696-57-0x0000000000140000-0x0000000000162000-memory.dmp

Filesize
136KB

Download
memory/1696-59-0x0000000000140000-0x0000000000162000-memory.dmp

Filesize
136KB

Download
memory/1696-63-0x0000000000140000-0x0000000000162000-memory.dmp

Filesize
136KB

Download