qakbot | a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd

Resubmissions

14-02-2023 11:56

230214-n4ad2ace4y 10

09-02-2023 19:59

230209-yqlv1sah97 3

Analysis

max time kernel
104s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-02-2023 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

suspicious.dll
Size

1.7MB
MD5

ace1226b3f17cf0cb6e6c3ceae7b95d8
SHA1

369ca9e31a31709641c2491bb895d55b20d5c90c
SHA256

a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd
SHA512

dba25ddeffe58e9258ce39aa3bd1509b6ce115fb6f097992fcce97134f8c7a212dfe5a4061c5c5fadaeba131b3336ccdb3cd79aa01dc53b4f063f6ebd7212540
SSDEEP

24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de

Score

10^/10

qakbot bb12 1675417198 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

BB12

Campaign

1675417198

12.172.173.82:995

12.172.173.82:2087

50.68.204.71:443

84.215.202.22:443

98.175.176.254:995

184.155.91.69:443

50.68.186.195:443

183.87.163.165:443

172.248.42.122:443

93.156.100.20:443

102.156.32.143:443

50.60.157.175:995

75.143.236.149:443

69.133.162.35:443

105.184.159.165:995

130.43.172.217:2222

82.36.36.76:443

73.223.248.31:443

202.142.98.62:443

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid	Process
2016	rundll32.exe
2016	rundll32.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

rundll32.exewermgr.exe

pid	Process
2016	rundll32.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe
620	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid	Process
2016	rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 2016 wrote to memory of 768	2016	rundll32.exe	28
PID 2016 wrote to memory of 768	2016	rundll32.exe	28
PID 2016 wrote to memory of 768	2016	rundll32.exe	28
PID 2016 wrote to memory of 768	2016	rundll32.exe	28
PID 2016 wrote to memory of 620	2016	rundll32.exe	29
PID 2016 wrote to memory of 620	2016	rundll32.exe	29
PID 2016 wrote to memory of 620	2016	rundll32.exe	29
PID 2016 wrote to memory of 620	2016	rundll32.exe	29
PID 2016 wrote to memory of 620	2016	rundll32.exe	29
PID 2016 wrote to memory of 620	2016	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll, Wind
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll, Wind
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    PID:768
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\38C60B70.dll

Filesize
268KB

MD5
53bb811ed12d2c867b354390fabf9612

SHA1
81b29c540c0e2a09385cf7e821639ff64fbffd91

SHA256
a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

SHA512
5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

Download Submit
\Users\Admin\AppData\Local\Temp\BD7C394C.dll

Filesize
268KB

MD5
53bb811ed12d2c867b354390fabf9612

SHA1
81b29c540c0e2a09385cf7e821639ff64fbffd91

SHA256
a972b482b09e50875c5cdc2cfd6c9b2fa96c9dbf9d23894d0b3061c97145b133

SHA512
5f7b584b9b42b0dc6ebbd3571cac1bc07c16301a994c9891201007c7b8698ef4604b2cc1f7e9a2edb016e50d415a6a9ca390a0df89bab01c889c7d382d2e8d24

Download Submit
memory/620-63-0x0000000000000000-mapping.dmp

Download
memory/620-65-0x0000000000080000-0x00000000000A3000-memory.dmp

Filesize
140KB

Download
memory/620-66-0x0000000000080000-0x00000000000A3000-memory.dmp

Filesize
140KB

Download
memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download