qakbot | 6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114

Resubmissions

12-06-2023 19:25

230612-x41ewsea3z 10

12-06-2023 19:19

230612-x1mdvsdd65 3

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2023 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll
Size

260KB
MD5

d5916cb2ff52e0411bc80a716b2aa528
SHA1

98baa0c511f8595f3a8b28c5ae1d69717b855791
SHA256

6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114
SHA512

618ef15305dd64d82e65e81fee659a59313998fab0d493accc122cc6795abbffcf1e31bcb1aff34413706c220777b3834a8f46240e60aca85e8d1d523f990deb
SSDEEP

6144:woGZATIJ/rRDAmZ0CI1jp8qTiAS1fW0PBJ+Y:woGGTM/hnZ0VayYv+Y

Score

10^/10

qakbot bb20 1679481679 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.476

Botnet

BB20

Campaign

1679481679

103.111.70.66:995

67.10.2.240:995

78.130.215.67:443

174.4.89.3:443

47.132.248.132:443

92.159.173.52:2222

75.143.236.149:443

80.42.186.99:2222

213.91.235.146:443

73.165.119.20:443

74.92.243.113:50000

12.172.173.82:20

162.248.14.107:443

50.68.204.71:993

92.186.69.229:2222

176.142.207.63:443

109.159.118.229:2222

85.231.105.49:2222

50.68.204.71:443

70.55.67.13:2222

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
1524	rundll32.exe
1524	rundll32.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe
3680	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1524 rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1516 wrote to memory of 1524	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1524	1516	rundll32.exe	rundll32.exe
PID 1516 wrote to memory of 1524	1516	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 3680	1524	rundll32.exe	wermgr.exe
PID 1524 wrote to memory of 3680	1524	rundll32.exe	wermgr.exe
PID 1524 wrote to memory of 3680	1524	rundll32.exe	wermgr.exe
PID 1524 wrote to memory of 3680	1524	rundll32.exe	wermgr.exe
PID 1524 wrote to memory of 3680	1524	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll, GL70
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll, GL70
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-138-0x0000000074EC0000-0x0000000074F04000-memory.dmp

Filesize
272KB

Download
memory/1524-134-0x0000000002E40000-0x0000000002E75000-memory.dmp

Filesize
212KB

Download
memory/1524-135-0x0000000002E40000-0x0000000002E75000-memory.dmp

Filesize
212KB

Download
memory/1524-136-0x0000000002E40000-0x0000000002E75000-memory.dmp

Filesize
212KB

Download
memory/1524-133-0x0000000074EC0000-0x0000000074F04000-memory.dmp

Filesize
272KB

Download
memory/3680-139-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-137-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-140-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-141-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-142-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-143-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-145-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download
memory/3680-147-0x0000000001260000-0x0000000001295000-memory.dmp

Filesize
212KB

Download