qakbot | 8fa27c003964cdef9ddfac52df9066c6d06d290e8a10e98f70722b7be5021f7c

Analysis

max time kernel
49s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/12/2022, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbf889fd98a557f0cfc01b19ed4ce344b1f5c384847843aa2c7d12664f0f093b.dll
Size

420KB
MD5

ed1a5a0f17b4e1e462ce2a4623ca14af
SHA1

27fc7aaa54296482ea0f4e4ded46e040e07433a1
SHA256

bbf889fd98a557f0cfc01b19ed4ce344b1f5c384847843aa2c7d12664f0f093b
SHA512

43e63c65ca1a43b1aaba1ea520a9926c6058fcf611f4a333d2617442b2bd76a2dbf2f0fb49d0c027a6a8da06c38c588ab7866edba14bc7296c07880b09636007
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663148750

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	1944	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	regsvr32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2008	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 1976 wrote to memory of 2008	1976	regsvr32.exe	26
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1944	2008	regsvr32.exe	27
PID 1944 wrote to memory of 1440	1944	explorer.exe	28
PID 1944 wrote to memory of 1440	1944	explorer.exe	28
PID 1944 wrote to memory of 1440	1944	explorer.exe	28
PID 1944 wrote to memory of 1440	1944	explorer.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bbf889fd98a557f0cfc01b19ed4ce344b1f5c384847843aa2c7d12664f0f093b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bbf889fd98a557f0cfc01b19ed4ce344b1f5c384847843aa2c7d12664f0f093b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 408
      4⤵
      Program crash
      PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-62-0x0000000073EC1000-0x0000000073EC3000-memory.dmp

Filesize
8KB

Download
memory/1944-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1944-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1976-54-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/2008-56-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/2008-57-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2008-59-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download
memory/2008-63-0x00000000001E0000-0x0000000000202000-memory.dmp

Filesize
136KB

Download