qakbot | d277f62b4d361b03beb59506f07d288d187b9d8b33b4aa6cba8d51b856d15d2e

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

run.bat
Size

22B
MD5

7982f3323acdaed4489c85a01440ae87
SHA1

746dbd816277a21b6805a3ac7defd12a26465e30
SHA256

35cf33e0a4d9265c233f27095b90b93b1083a97f68295102266edee608045543
SHA512

0babfc6388260f933e40397c4ae1a7289feb22f326f5da7f3d2cc78589c09e6aed3b6da43cd47330ead65ce8a65a3b392e103b70d1a2b62a921679fa0e217650

Score

10^/10

qakbot bb21 1680106938 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.843

Botnet

BB21

Campaign

1680106938

94.30.31.47:50000

72.88.245.71:443

136.35.241.159:443

74.92.243.115:50000

47.196.225.236:443

71.46.234.171:443

50.68.204.71:443

78.130.215.67:443

46.64.171.68:443

92.186.69.229:2222

68.173.170.110:8443

75.90.87.37:995

94.30.98.134:32100

24.236.90.196:2078

162.248.14.107:443

72.203.216.98:2222

67.219.197.94:443

78.69.251.252:2222

50.68.204.71:993

174.4.89.3:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1424	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	rundll32.exe
4632	rundll32.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe
4032	wermgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4632	rundll32.exe
2040	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	tasklist.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1840	2676	cmd.exe	83
PID 2676 wrote to memory of 1840	2676	cmd.exe	83
PID 1840 wrote to memory of 4632	1840	rundll32.exe	84
PID 1840 wrote to memory of 4632	1840	rundll32.exe	84
PID 1840 wrote to memory of 4632	1840	rundll32.exe	84
PID 4632 wrote to memory of 4032	4632	rundll32.exe	85
PID 4632 wrote to memory of 4032	4632	rundll32.exe	85
PID 4632 wrote to memory of 4032	4632	rundll32.exe	85
PID 4632 wrote to memory of 4032	4632	rundll32.exe	85
PID 4632 wrote to memory of 4032	4632	rundll32.exe	85
PID 1744 wrote to memory of 1648	1744	cmd.exe	103
PID 1744 wrote to memory of 1648	1744	cmd.exe	103
PID 1648 wrote to memory of 2040	1648	rundll32.exe	104
PID 1648 wrote to memory of 2040	1648	rundll32.exe	104
PID 1648 wrote to memory of 2040	1648	rundll32.exe	104
PID 2040 wrote to memory of 2668	2040	rundll32.exe	105
PID 2040 wrote to memory of 2668	2040	rundll32.exe	105
PID 2040 wrote to memory of 2668	2040	rundll32.exe	105
PID 2040 wrote to memory of 2668	2040	rundll32.exe	105
PID 2040 wrote to memory of 2668	2040	rundll32.exe	105
PID 1744 wrote to memory of 1424	1744	cmd.exe	106
PID 1744 wrote to memory of 1424	1744	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\rundll32.exe
  rundll32 dll.dll,X555
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 dll.dll,X555
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4032

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\rundll32.exe
  rundll32 dll.dll, X555
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 dll.dll, X555
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      PID:2668
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-155-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2040-157-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2040-156-0x00000000029F0000-0x00000000029FE000-memory.dmp

Filesize
56KB

Download
memory/2668-159-0x0000000000440000-0x000000000049F000-memory.dmp

Filesize
380KB

Download
memory/2668-158-0x0000000000440000-0x000000000049F000-memory.dmp

Filesize
380KB

Download
memory/4032-141-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-143-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-144-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-145-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-146-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-148-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-142-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4032-160-0x0000000000690000-0x00000000006EF000-memory.dmp

Filesize
380KB

Download
memory/4632-133-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/4632-140-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/4632-139-0x0000000000A10000-0x0000000000A1E000-memory.dmp

Filesize
56KB

Download
memory/4632-138-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download