qakbot | cd1c25dd94c4ea3aacb4b6b3b37a5922eb0feb4cbf505d7c6c29705b9ac14a21

Analysis

max time kernel
151s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-01-2023 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NewInformation/CancelledInvoice.cmd
Size

13KB
MD5

1b07a61cdc3665c8ddb2929de8527d78
SHA1

ea18f6a08734ef03e6908430d2b9842865becdaf
SHA256

ec997c9416b3b468f09a9a8db69ced4a5413e500b60f529a5ea628325775abd6
SHA512

4f03ba02c43af7e2b2d30123b2d4c3c67536742c63844710b4253e62aa4c809654d3914784413a9096198412aa44f81d60aab9c48a0cc301ab6a8a6d8d955fd1
SSDEEP

384:IoqkxKlAYctpZnkGHhJMfHz0/KOver/EGsb8YJohds1Ik7xUT:l3KncdnkGHbMfHz0XercGsbb2dhk7xUT

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1984	rundll32.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe
1532	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

cmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 1952	1944	cmd.exe	rundll32.exe
PID 1944 wrote to memory of 1952	1944	cmd.exe	rundll32.exe
PID 1944 wrote to memory of 1952	1944	cmd.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 1984	1952	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe
PID 1984 wrote to memory of 1532	1984	rundll32.exe	wermgr.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\NewInformation\CancelledInvoice.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\system32\rundll32.exe
rundll32 /s newissues.find,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
rundll32 /s newissues.find,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-62-0x0000000000000000-mapping.dmp

Download
memory/1532-64-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1532-65-0x0000000000080000-0x00000000000AA000-memory.dmp

Filesize
168KB

Download
memory/1952-54-0x0000000000000000-mapping.dmp

Download
memory/1984-55-0x0000000000000000-mapping.dmp

Download
memory/1984-56-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1984-57-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download