qakbot | de2517dfb2180d476bad32be431dbb3361a57439cd018f913533ce41a9a6c5db

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/01/2023, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0901c53c9cbc5dc903432d42d9eb2bc620a65c36060328ac2959fbd86fdbbb.dll
Size

427KB
MD5

aedb338079f0d0aecc1cc1b7c403e4e4
SHA1

9d4d3b8633f46e13e9917efeff2a0722fd6988f4
SHA256

3d0901c53c9cbc5dc903432d42d9eb2bc620a65c36060328ac2959fbd86fdbbb
SHA512

974ff3aeee006ba33ea77d944517da92a5f8aa831303cfeecd79c9b0455df65a2befa64687cf8e624dee10e815413eca9c097a7c57753fbed6237fcc76167aeb
SSDEEP

6144:36N5XNlCfcqFhOdpwNzM2a3gfwp3NkOWuzv/24bktfTGoH:KrducqxNzbaP3WOWuLTCfThH

Score

10^/10

qakbot bb 1663148750 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663148750

193.3.19.37:443

99.232.140.205:2222

99.253.251.74:443

197.94.210.133:443

37.210.148.30:995

14.161.194.86:443

154.181.203.230:995

200.161.62.126:32101

134.35.10.122:443

64.207.215.69:443

81.131.161.131:2078

217.165.85.223:993

78.100.225.34:2222

85.114.110.108:443

102.38.96.108:995

123.240.131.1:443

109.158.159.179:993

186.105.182.127:443

190.44.40.48:995

88.233.194.154:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1724	regsvr32.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe
468	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1724	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 840 wrote to memory of 1724	840	regsvr32.exe	28
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 1724 wrote to memory of 468	1724	regsvr32.exe	29
PID 468 wrote to memory of 580	468	explorer.exe	30
PID 468 wrote to memory of 580	468	explorer.exe	30
PID 468 wrote to memory of 580	468	explorer.exe	30
PID 468 wrote to memory of 580	468	explorer.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d0901c53c9cbc5dc903432d42d9eb2bc620a65c36060328ac2959fbd86fdbbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3d0901c53c9cbc5dc903432d42d9eb2bc620a65c36060328ac2959fbd86fdbbb.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 18:36 /tn cahduzm /ET 18:47 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMwBkADAAOQAwADEAYwA1ADMAYwA5AGMAYgBjADUAZABjADkAMAAzADQAMwAyAGQANAAyAGQAOQBlAGIAMgBiAGMANgAyADAAYQA2ADUAYwAzADYAMAA2ADAAMwAyADgAYQBjADIAOQA1ADkAZgBiAGQAOAA2AGYAZABiAGIAYgAuAGQAbABsACIA" /SC ONCE
      4⤵
      Creates scheduled task(s)
      PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-62-0x0000000073F71000-0x0000000073F73000-memory.dmp

Filesize
8KB

Download
memory/468-64-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/468-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/840-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1724-57-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1724-59-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download
memory/1724-63-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download