qakbot | a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd

Resubmissions

14-02-2023 11:56

230214-n4ad2ace4y 10

09-02-2023 19:59

230209-yqlv1sah97 3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

suspicious.dll
Size

1.7MB
MD5

ace1226b3f17cf0cb6e6c3ceae7b95d8
SHA1

369ca9e31a31709641c2491bb895d55b20d5c90c
SHA256

a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd
SHA512

dba25ddeffe58e9258ce39aa3bd1509b6ce115fb6f097992fcce97134f8c7a212dfe5a4061c5c5fadaeba131b3336ccdb3cd79aa01dc53b4f063f6ebd7212540
SSDEEP

24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de

Score

10^/10

qakbot bb12 1675417198 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.432

Botnet

BB12

Campaign

1675417198

12.172.173.82:995

12.172.173.82:2087

50.68.204.71:443

84.215.202.22:443

98.175.176.254:995

184.155.91.69:443

50.68.186.195:443

183.87.163.165:443

172.248.42.122:443

93.156.100.20:443

102.156.32.143:443

50.60.157.175:995

75.143.236.149:443

69.133.162.35:443

105.184.159.165:995

130.43.172.217:2222

82.36.36.76:443

73.223.248.31:443

202.142.98.62:443

73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid	Process
428	rundll32.exe
428	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	Process
428	rundll32.exe
428	rundll32.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe
4340	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid	Process
428	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 4372 wrote to memory of 428	4372	rundll32.exe	82
PID 4372 wrote to memory of 428	4372	rundll32.exe	82
PID 4372 wrote to memory of 428	4372	rundll32.exe	82
PID 428 wrote to memory of 4352	428	rundll32.exe	83
PID 428 wrote to memory of 4352	428	rundll32.exe	83
PID 428 wrote to memory of 4352	428	rundll32.exe	83
PID 428 wrote to memory of 4340	428	rundll32.exe	84
PID 428 wrote to memory of 4340	428	rundll32.exe	84
PID 428 wrote to memory of 4340	428	rundll32.exe	84
PID 428 wrote to memory of 4340	428	rundll32.exe	84
PID 428 wrote to memory of 4340	428	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll, Wind
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll, Wind
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15F4D004.dll

Filesize
2.1MB

MD5
f530495445432d6ae00f2b0f08f7c804

SHA1
f66f538b95b1a924c8392fbe7743d193d78eb50c

SHA256
5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

SHA512
2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CA9436C8.dll

Filesize
2.1MB

MD5
f530495445432d6ae00f2b0f08f7c804

SHA1
f66f538b95b1a924c8392fbe7743d193d78eb50c

SHA256
5cc51f26704eef3b59e6d33ea690fa5c62237627269493ead5bad6f71d2de07b

SHA512
2b44ed622e63014a0d2d613d8bbc1548dd193460ce7711414dc4eb62a2aef69d57c9821f834555539b6a49f584cb46c5e82a9867ab0a0733d78e4f1d032d6ce8

Download Submit
memory/428-132-0x0000000000000000-mapping.dmp

Download
memory/428-133-0x0000000001010000-0x0000000001033000-memory.dmp

Filesize
140KB

Download
memory/4340-140-0x0000000000000000-mapping.dmp

Download
memory/4340-141-0x0000000000870000-0x0000000000893000-memory.dmp

Filesize
140KB

Download
memory/4340-142-0x0000000000870000-0x0000000000893000-memory.dmp

Filesize
140KB

Download