qakbot | 2caaddf05cadaa97c3e32c7b5782dac7cdc04fd14806ba354407d11bfa3d7ff6

Analysis

max time kernel
39s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a8eaba3e849a06e7039dca243f584b0f38cd4179a511b5f2b6543681ed6dbc.dll
Size

426KB
MD5

8b36bde1e395b6385024423778c8eaeb
SHA1

bdce1998234176a654a9a1a26a4d295f9de6b118
SHA256

f9a8eaba3e849a06e7039dca243f584b0f38cd4179a511b5f2b6543681ed6dbc
SHA512

14bfb23484fd99aac2c191264cf0067c966c7aaa6a4d24e073c5d4b6c254d8b0fda72aae93b16961331e7199ed11ac6b9c1213a75710f31b4fd8d21c833f8d2e
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663148750

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	1344	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1540	regsvr32.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1540	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1772 wrote to memory of 1540	1772	regsvr32.exe	28
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1540 wrote to memory of 1344	1540	regsvr32.exe	29
PID 1344 wrote to memory of 872	1344	explorer.exe	30
PID 1344 wrote to memory of 872	1344	explorer.exe	30
PID 1344 wrote to memory of 872	1344	explorer.exe	30
PID 1344 wrote to memory of 872	1344	explorer.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f9a8eaba3e849a06e7039dca243f584b0f38cd4179a511b5f2b6543681ed6dbc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f9a8eaba3e849a06e7039dca243f584b0f38cd4179a511b5f2b6543681ed6dbc.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 404
      4⤵
      Program crash
      PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-62-0x0000000074921000-0x0000000074923000-memory.dmp

Filesize
8KB

Download
memory/1344-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1344-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1540-56-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1540-57-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1540-59-0x00000000002C0000-0x0000000000340000-memory.dmp

Filesize
512KB

Download
memory/1540-63-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1772-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download