qakbot | 031094100c0450c6680cf0debb4830f9e62d9853ce3f1b25581ddcecc8fac6b2

Resubmissions

26-12-2022 16:35

221226-t3ym5adb75 10

26-12-2022 13:17

221226-qjpdkagb7s 10

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RecentInformation/InvoiceUpdate.cmd
Size

12KB
MD5

af6d4b315d76e50ced1727b29845ba7f
SHA1

daef150d406c440ca2ecebe7430dee268ef1d304
SHA256

c68297cdc9f8a989760c7cd6aa6bc726f1b8967fbc3860e130e20707e250977d
SHA512

10e754f8582468b2d3ecda6f5a39ba1b98c121b02454a276a319c354b34b8199cc1949434491f3a6209c3b4b04b63bd086c5b0e44298f86129bdf2bf685e7756
SSDEEP

192:0JV6i8Elig40KDEo5LHdIbHKM9ugVyECQla3Z9aTmha9TTupZaJKaRBCaQBacsa0:0JV6i8E7K17MaZSW+NHxsY

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1680	rundll32.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe
1224	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1680 rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 900	1696	cmd.exe	rundll32.exe
PID 1696 wrote to memory of 900	1696	cmd.exe	rundll32.exe
PID 1696 wrote to memory of 900	1696	cmd.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe
PID 1680 wrote to memory of 1224	1680	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RecentInformation\InvoiceUpdate.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\system32\rundll32.exe
rundll32 /s needchangerules.fw,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s needchangerules.fw,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000000000000-mapping.dmp

Download
memory/1224-62-0x0000000000000000-mapping.dmp

Download
memory/1224-64-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1224-65-0x00000000000C0000-0x00000000000EA000-memory.dmp

Filesize
168KB

Download
memory/1680-55-0x0000000000000000-mapping.dmp

Download
memory/1680-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1680-57-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download