qakbot | d4d75083ac66853e473d7d368132e5f0ceb11862b1c7e1fdadf659fe11596512

Resubmissions

29-12-2022 15:30

221229-sxjfksdc98 10

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-12-2022 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Information/LASTInformation.cmd
Size

13KB
MD5

a77f70b0473b5ec7680858c54029a26b
SHA1

2c42f1508803e331c174b3b9e055ad74120e8b68
SHA256

c087c02ff375573215a32974e9a5e61d708a10a7ae528189046c8a67740d7741
SHA512

5bb3c900fe75ba228fb347bd4906fbb00b6c73abad19a5e5403ad74a1c905f2ec6b3cafdf78b13ff938b5b889b7e771a6b3b19b8000368d144d6cff7868000e9
SSDEEP

384:nSgzTvsr0CfywwYCcKEGovE7p9fIMuayslNJbY:Sg/vsoCfKYCnEGZ7p9fIMua7NJ0

Score

10^/10

qakbot azd 1672147664 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1672147664

80.103.77.44:2222

136.35.241.159:443

73.88.173.113:443

186.64.67.12:443

76.80.180.154:995

83.248.199.56:443

125.20.112.94:443

72.80.7.6:995

50.68.204.71:443

90.79.129.166:2222

108.162.6.34:443

86.130.9.250:2222

41.228.225.131:995

86.134.75.5:443

190.249.241.149:443

70.115.104.126:995

84.113.121.103:443

198.2.51.242:993

172.90.139.138:2222

89.115.196.99:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1068	rundll32.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe
1576	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1068 rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1784 wrote to memory of 2040	1784	cmd.exe	rundll32.exe
PID 1784 wrote to memory of 2040	1784	cmd.exe	rundll32.exe
PID 1784 wrote to memory of 2040	1784	cmd.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1068	2040	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe
PID 1068 wrote to memory of 1576	1068	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Information\LASTInformation.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\system32\rundll32.exe
rundll32 /s document.bin,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s document.bin,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-55-0x0000000000000000-mapping.dmp

Download
memory/1068-56-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1068-57-0x0000000000150000-0x000000000017A000-memory.dmp

Filesize
168KB

Download
memory/1576-62-0x0000000000000000-mapping.dmp

Download
memory/1576-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1576-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/2040-54-0x0000000000000000-mapping.dmp

Download