qakbot | 4556ee5424b694fdac20053375825b01a608381af1dab4363711009eb2674447

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2022 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NewInformation/Information.cmd
Size

12KB
MD5

ea8e5a3d24f3c9d2f203cb53dae8a60c
SHA1

a616c3e0d546a295ffc9b53a0c80227c2a2ceab1
SHA256

037098d89c2cfc42d878d3966694b664c5ffbe73a2e1cfd9c3e3f5a4966b453f
SHA512

5506eb691825134afe76a4b7f8ecb3bbc6a7d116788e8ea2376ccb64c0527a7030a94ba47e13723e839ae73fa60f90fbb20b991386fcbae938d34d76003cd040
SSDEEP

192:C1RGxipT0Ny0ZXMefAX0x2O/GhODhR6h8DcpqLbzAo6vWnFPK05t0vPmS:C7GxKOy0Rf/UPhQRe8D/B6UTtcPT

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
2392	rundll32.exe
2392	rundll32.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe
672	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2392 rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 4712 wrote to memory of 4580	4712	cmd.exe	rundll32.exe
PID 4712 wrote to memory of 4580	4712	cmd.exe	rundll32.exe
PID 4580 wrote to memory of 2392	4580	rundll32.exe	rundll32.exe
PID 4580 wrote to memory of 2392	4580	rundll32.exe	rundll32.exe
PID 4580 wrote to memory of 2392	4580	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 672	2392	rundll32.exe	wermgr.exe
PID 2392 wrote to memory of 672	2392	rundll32.exe	wermgr.exe
PID 2392 wrote to memory of 672	2392	rundll32.exe	wermgr.exe
PID 2392 wrote to memory of 672	2392	rundll32.exe	wermgr.exe
PID 2392 wrote to memory of 672	2392	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NewInformation\Information.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\system32\rundll32.exe
rundll32 /s lastinformation.local,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s lastinformation.local,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-139-0x0000000000000000-mapping.dmp

Download
memory/672-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/672-141-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2392-133-0x0000000000000000-mapping.dmp

Download
memory/2392-134-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/4580-132-0x0000000000000000-mapping.dmp

Download