qakbot | 15d37b513139b5a248ee4b91b311bf5f1bfd74e5d57ab8b33e3bab12137822dc

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/05/2023, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oOo.dll
Size 435KB
Sample230512-pljenada77
SHA256 15d37b513139b5a248ee4b91b311bf5f1bfd74e5d57ab8b33e3bab12137822dc
MD5 438d33ed4f70d5fde97fe60e6e62da82
SHA1 6ffc71cdfa83dfe6a4cd45c4cc30df181d618d4d
SHA512 ee1bcfe6ec3120f63420728fffeba528ee70ef48b2cf1bf4914e9498ace83a0f09257cddf80f6b4bbb0a9c185ec86e9b9838c7ae2bc6070f099fdcd1bc3e4955
SSDEEP 6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8F:9/Cw6Z4nilhFX8mCXDckOPeJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb27 1683816541 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683816541

68.68.170.218:443
142.189.121.178:2222
213.91.235.146:443
71.78.95.86:995
92.9.45.20:2222
81.229.117.95:2222
201.244.108.183:995
50.68.186.195:443
90.104.151.37:2222
92.188.241.102:443
198.2.51.242:993
12.172.173.82:20
72.222.73.150:443
31.190.225.7:443
70.54.65.197:2222
70.28.50.223:2083
172.115.17.50:443
70.112.206.5:443
122.184.143.86:443
47.32.78.150:443
92.239.81.124:443
47.199.241.39:443
67.177.41.245:443
72.134.124.16:443
12.172.173.82:995
99.230.89.236:2078
87.202.101.164:50000
193.253.53.157:2078
76.178.148.107:2222
41.186.88.38:443
147.219.4.194:443
47.34.30.133:443
68.14.195.55:995
98.37.25.99:443
188.28.72.118:443
119.82.121.87:443
67.10.9.125:995
184.182.66.109:443
78.192.109.105:2222
74.92.243.115:50000
85.61.165.153:2222
97.93.192.2:2083
62.35.100.38:443
98.187.21.2:443
81.156.1.223:443
84.108.200.161:443
190.141.193.170:443
96.56.197.26:2222
86.196.12.21:2222
72.205.104.134:443
197.148.17.17:2078
70.53.193.201:2222
47.205.25.170:443
207.107.118.2:443
12.172.173.82:465
75.143.236.149:443
72.188.103.221:443
14.192.241.76:995
84.35.26.14:995
86.140.160.231:2222
70.28.50.223:1194
108.190.115.159:443
24.69.137.232:2222
47.21.51.138:443
173.206.84.174:443
79.47.207.6:443
76.16.49.134:443
64.121.161.102:443
98.19.224.125:995
184.176.35.223:2222
67.61.61.31:443
80.12.88.148:2222
75.109.111.89:443
12.20.0.235:2222
88.126.94.4:50000
88.171.156.150:50000
75.98.154.19:443
70.51.136.238:2222
96.87.28.170:2222
73.22.121.210:443
113.11.92.30:443
86.130.9.208:2222
27.109.19.90:2078
70.28.50.223:32100
89.129.109.27:2222
12.172.173.82:21
70.28.50.223:2087
200.93.26.107:2222
50.68.204.71:993
12.172.173.82:32101
173.88.135.179:443
70.28.50.223:3389
86.99.48.130:2222
67.219.197.94:443
76.64.99.251:2222
86.250.12.86:2222
136.35.241.159:443
69.157.243.204:2222
216.36.153.248:443
173.176.4.133:443
92.154.17.149:2222
178.152.124.169:443
83.114.60.6:2222
24.206.27.39:443
184.153.132.82:443
68.109.240.71:443
208.180.17.32:2222
109.159.119.82:2222
186.52.239.187:995
190.28.74.251:443
86.244.255.82:2222
12.172.173.82:993
50.68.204.71:995
50.68.204.71:443
96.56.197.26:2083
37.14.229.220:2222
162.248.14.107:443
186.64.67.41:443
70.28.50.223:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1160	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	rundll32.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe
1328	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1920	rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 324 wrote to memory of 1920	324	rundll32.exe	26
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1920 wrote to memory of 1328	1920	rundll32.exe	27
PID 1328 wrote to memory of 1160	1328	wermgr.exe	28
PID 1328 wrote to memory of 1160	1328	wermgr.exe	28
PID 1328 wrote to memory of 1160	1328	wermgr.exe	28
PID 1328 wrote to memory of 1160	1328	wermgr.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\oOo.dll,print
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\oOo.dll,print
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\ping.exe
      ping -n 3 yahoo.com
      4⤵
      Runs ping.exe
      PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-60-0x00000000000B0000-0x00000000000B2000-memory.dmp

Download

memory/1328-61-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-62-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-63-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-64-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-65-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-66-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-67-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1328-69-0x0000000000080000-0x00000000000A4000-memory.dmp

Download

memory/1920-54-0x0000000000140000-0x0000000000143000-memory.dmp

Download

memory/1920-55-0x0000000010000000-0x0000000010024000-memory.dmp

Download