qakbot | cf3dd891fa90e3b64cd1aa99bae1fcbd0b402c7481d73886942451a6df66a223

General

Target

573f2d325bc740256fd9ef4c72c4ffcc446d7008d0a6ce9b6706b2d5172dcd20.dll
Size

606KB
MD5

3749841bdd0650f2f9265d89c00ea328
SHA1

d808341a4dfee8578bada9683459b0c8bf6ce79c
SHA256

573f2d325bc740256fd9ef4c72c4ffcc446d7008d0a6ce9b6706b2d5172dcd20
SHA512

b2e716afe9cc590c4290d3c099aa741e88f7f2c748843c5f01f51c32f0c0e1aceb6983a16361c5a89343a3f0e9eb737f47c20282b4af99c36d39095d323bf472
SSDEEP

6144:k/ZzllHDjygb7kZJUP9SDTOq3WlrQQurP/o2SiN5ryK9T+gZw/NCxeczYjlDtKK8:+HDjygXeIBrbYXPCd/NyYxRGu5DO

Score

10^/10

qakbot bb22 1680688614 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.909

Botnet

BB22

Campaign

1680688614

C2

209.93.207.224:2222

90.93.132.149:2222

109.11.175.42:2222

12.172.173.82:993

86.195.14.72:2222

82.121.195.187:2222

88.122.133.88:32100

86.154.216.221:2222

91.82.133.190:443

197.3.198.241:443

70.112.206.5:443

12.172.173.82:50001

103.123.223.141:443

103.141.50.102:995

201.244.108.183:995

183.87.163.165:443

76.178.148.107:2222

96.87.28.170:2222

76.80.180.154:993

92.189.214.236:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

524 ping.exe

pid	process
524	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
2004	rundll32.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe
1164	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exewermgr.exe

description	pid	process	target process
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 2004 wrote to memory of 1164	2004	rundll32.exe	wermgr.exe
PID 1164 wrote to memory of 524	1164	wermgr.exe	ping.exe
PID 1164 wrote to memory of 524	1164	wermgr.exe	ping.exe
PID 1164 wrote to memory of 524	1164	wermgr.exe	ping.exe
PID 1164 wrote to memory of 524	1164	wermgr.exe	ping.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\573f2d325bc740256fd9ef4c72c4ffcc446d7008d0a6ce9b6706b2d5172dcd20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\573f2d325bc740256fd9ef4c72c4ffcc446d7008d0a6ce9b6706b2d5172dcd20.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\ping.exe
ping -n 3 yahoo.com
4⤵
- Runs ping.exe
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-64-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1164-75-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-73-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-72-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-71-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-70-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-68-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-66-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/1164-65-0x0000000000100000-0x0000000000124000-memory.dmp

Filesize
144KB

Download
memory/2004-62-0x0000000000830000-0x00000000008C3000-memory.dmp

Filesize
588KB

Download
memory/2004-54-0x0000000000830000-0x00000000008C3000-memory.dmp

Filesize
588KB

Download
memory/2004-61-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-67-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-60-0x00000000006F0000-0x0000000000716000-memory.dmp

Filesize
152KB

Download
memory/2004-58-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-59-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-57-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-56-0x00000000007B0000-0x00000000007D4000-memory.dmp

Filesize
144KB

Download
memory/2004-55-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing