qakbot | f89edf7ea7c7ca41ba2d4d45b07767ace31cb34352dd2b16ed86313377ab44a1

Analysis

max time kernel
150s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-12-2022 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df061c563428c88fb1f50232a5b1e28b9750b69a9b11edc68636ba107840909.dll
Size

445KB
MD5

879c43f232aa22cbc9a39db6d540e67a
SHA1

0502f9c0d662dea67db98a2d64c7020eb58521d5
SHA256

0df061c563428c88fb1f50232a5b1e28b9750b69a9b11edc68636ba107840909
SHA512

9f127671cf8636aa6dfc13b8a81ce61124d03870b04908e907daff07b15e26339b83cbf2139756d5feebd4eb65c2e4a9ea5dc9a7b76bff06481dbd6c5b8a6cf0
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663148750

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	regsvr32.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2004	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1696	2004	regsvr32.exe	27
PID 1696 wrote to memory of 1516	1696	explorer.exe	28
PID 1696 wrote to memory of 1516	1696	explorer.exe	28
PID 1696 wrote to memory of 1516	1696	explorer.exe	28
PID 1696 wrote to memory of 1516	1696	explorer.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0df061c563428c88fb1f50232a5b1e28b9750b69a9b11edc68636ba107840909.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0df061c563428c88fb1f50232a5b1e28b9750b69a9b11edc68636ba107840909.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 22:15 /tn bdzoezis /ET 22:26 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMABkAGYAMAA2ADEAYwA1ADYAMwA0ADIAOABjADgAOABmAGIAMQBmADUAMAAyADMAMgBhADUAYgAxAGUAMgA4AGIAOQA3ADUAMABiADYAOQBhADkAYgAxADEAZQBkAGMANgA4ADYAMwA2AGIAYQAxADAANwA4ADQAMAA5ADAAOQAuAGQAbABsACIA" /SC ONCE
      4⤵
      Creates scheduled task(s)
      PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-54-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/1516-65-0x0000000000000000-mapping.dmp

Download
memory/1696-60-0x0000000000000000-mapping.dmp

Download
memory/1696-62-0x00000000744B1000-0x00000000744B3000-memory.dmp

Filesize
8KB

Download
memory/1696-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1696-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2004-55-0x0000000000000000-mapping.dmp

Download
memory/2004-56-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2004-57-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/2004-59-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download
memory/2004-63-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download