qakbot | d5acb4f213d5c30c8ec893481883f0474b9fd3159067a80b138212fedfc0a2f3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

unknown.exe
Size

552KB
MD5

969ea177ca399240a5aa72efffc7e0be
SHA1

fb5e167c5ba21ea39e41812026d88e7619618ef5
SHA256

d5acb4f213d5c30c8ec893481883f0474b9fd3159067a80b138212fedfc0a2f3
SHA512

eb59e5134d25d8024615ba522dd4d9c5ad00c6aebecc0a803be8b649050d02742cbb4e7fbe875f6d985d7fd56a3a0c5f12477704959d0f54edfed69e86917e2f
SSDEEP

12288:47uM8sVm1kWF/eLJ+QlfW4MwauXWfFyDFfEWmqTqQpa4NLVZC:4+sVmhledMmGdu+ZqHzC

Score

10^/10

qakbot azd 1672147664 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1672147664

80.103.77.44:2222

136.35.241.159:443

73.88.173.113:443

186.64.67.12:443

76.80.180.154:995

83.248.199.56:443

125.20.112.94:443

72.80.7.6:995

50.68.204.71:443

90.79.129.166:2222

108.162.6.34:443

86.130.9.250:2222

41.228.225.131:995

86.134.75.5:443

190.249.241.149:443

70.115.104.126:995

84.113.121.103:443

198.2.51.242:993

172.90.139.138:2222

89.115.196.99:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

unknown.exewermgr.exe

pid	process
1932	unknown.exe
1932	unknown.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe
2640	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

unknown.exe

pid process

1932 unknown.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

unknown.exe

description	pid	process	target process
PID 1932 wrote to memory of 2640	1932	unknown.exe	wermgr.exe
PID 1932 wrote to memory of 2640	1932	unknown.exe	wermgr.exe
PID 1932 wrote to memory of 2640	1932	unknown.exe	wermgr.exe
PID 1932 wrote to memory of 2640	1932	unknown.exe	wermgr.exe
PID 1932 wrote to memory of 2640	1932	unknown.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\unknown.exe
"C:\Users\Admin\AppData\Local\Temp\unknown.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-132-0x0000000000980000-0x00000000009AA000-memory.dmp

Filesize
168KB

Download
memory/2640-137-0x0000000000000000-mapping.dmp

Download
memory/2640-138-0x0000000000FB0000-0x0000000000FDA000-memory.dmp

Filesize
168KB

Download
memory/2640-139-0x0000000000FB0000-0x0000000000FDA000-memory.dmp

Filesize
168KB

Download