qakbot | 1ee6690de8d097a84d740c20eab511153085e4895cab1c5192cb64703ee1db03

Resubmissions

22/06/2023, 14:04

230622-rc975aeg7310

22/06/2023, 13:59

230622-rajmdsga915

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2023, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
carre.dll
Size 1.1MB
Sample230622-rc975aeg73
SHA256 1ee6690de8d097a84d740c20eab511153085e4895cab1c5192cb64703ee1db03
MD5 0041e942efbd1dbb61c8a7ce4ed47401
SHA1 e5d9ca9b8962492d5fcaf9d6db3ef344dfe9d649
SHA512 4a132a6d196bd55aae81987745339f938a92345e4421b73027a268b821914283c98381913bd311ca5a76c522d601141dc53b30c4242069ad7c24cfd8a26cb54c
SSDEEP 24576:l3sUlO2TYFXw4M+B08NptUduyNVUnxM/jj5wDe2t:S5zVBHptAnUxSSe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb33 1687343976 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1382

Botnet

BB33

Campaign

1687343976

149.74.159.67:2222
184.176.35.223:2222
87.149.121.9:995
89.129.109.27:2222
151.62.196.183:443
24.198.114.130:995
96.87.28.170:2222
213.55.33.103:443
12.172.173.82:22
41.228.207.158:995
90.162.45.154:2222
102.130.200.134:2078
64.43.14.50:443
198.2.51.242:993
47.34.30.133:443
70.51.247.250:2222
168.149.47.12:443
68.186.65.132:443
88.126.94.4:50000
70.28.50.223:3389
70.49.205.191:2222
183.87.163.165:443
162.248.14.107:443
70.28.50.223:32100
147.147.30.126:2222
1.221.179.74:443
102.158.46.89:443
201.171.159.196:443
82.125.44.236:2222
98.4.43.111:443
2.82.8.80:443
81.150.169.174:2083
70.54.111.35:2222
103.153.180.60:995
184.176.110.61:61202
86.128.15.251:2222
70.160.67.203:443
12.172.173.82:50001
75.98.154.19:443
70.28.50.223:2078
67.87.119.216:2078
95.45.50.93:2222
72.4.96.62:443
213.64.33.92:2222
165.120.244.223:2222
70.28.50.223:2087
175.156.65.126:2222
47.205.25.170:443
86.178.33.59:2222
81.150.169.174:2078
91.165.188.74:50000
66.241.183.99:443
220.79.238.82:443
23.234.237.3:443
76.178.148.107:2222
136.232.179.26:443
92.186.69.229:2222
12.172.173.82:993
151.69.32.238:443
91.182.163.36:2222
174.4.89.3:443
119.82.95.142:2078
199.27.66.213:443
92.20.204.198:2222
84.35.26.14:995
81.229.117.95:2222
91.254.145.252:443
92.9.45.20:2222
12.172.173.82:20
91.169.12.198:32100
213.91.235.146:443
188.28.77.187:443
12.172.173.82:465
70.28.50.223:1194
201.208.135.13:2222
24.234.80.122:995
81.150.169.174:2222
121.121.100.202:995
105.184.8.190:995
12.172.173.82:21
184.182.66.109:443
64.229.117.208:2222
77.126.99.230:443
80.12.88.148:2222
87.252.106.235:995
12.172.173.82:32101
201.225.216.60:2222
116.88.76.28:443
217.165.255.105:443
92.27.86.48:2222
103.123.223.131:443
90.104.151.37:2222
27.0.48.233:443
72.205.104.134:443
12.172.173.82:2087
31.53.29.188:2222
37.14.229.220:2222
89.181.227.42:2222
182.75.189.42:995
62.35.230.21:995
198.255.148.59:443
88.171.156.150:50000
89.152.20.11:2222
161.142.100.114:995
122.184.143.84:443
223.166.13.95:995
197.83.246.187:443
79.168.224.165:2222
201.244.108.183:995
178.175.187.254:443
176.142.207.63:443
86.160.253.50:443
116.75.63.162:443
103.141.50.46:995
41.129.104.142:443
92.188.241.102:443
103.212.19.254:995
172.115.17.50:443
2.49.63.237:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	PowerShell.exe
1224	PowerShell.exe
2044	rundll32.exe
2044	rundll32.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe
5040	wermgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	PowerShell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3500	5024	rundll32.exe	79
PID 5024 wrote to memory of 3500	5024	rundll32.exe	79
PID 5024 wrote to memory of 3500	5024	rundll32.exe	79
PID 1224 wrote to memory of 4288	1224	PowerShell.exe	89
PID 1224 wrote to memory of 4288	1224	PowerShell.exe	89
PID 4288 wrote to memory of 2044	4288	rundll32.exe	90
PID 4288 wrote to memory of 2044	4288	rundll32.exe	90
PID 4288 wrote to memory of 2044	4288	rundll32.exe	90
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93
PID 2044 wrote to memory of 5040	2044	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\carre.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\carre.dll,#1
  2⤵
  PID:3500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4496

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" .\carre.dll,more
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" .\carre.dll,more
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gi1vzyp5.llm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gi1vzyp5.llm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1224-140-0x000001FA53D00000-0x000001FA53D22000-memory.dmp

Download

memory/1224-145-0x000001FA6CDB0000-0x000001FA6CDF4000-memory.dmp

Download

memory/1224-146-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/1224-147-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/1224-148-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/1224-149-0x000001FA6CE80000-0x000001FA6CEF6000-memory.dmp

Download

memory/1224-150-0x000001FA6BFB0000-0x000001FA6BFCE000-memory.dmp

Download

memory/1224-151-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/1224-152-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/1224-153-0x000001FA6BFE0000-0x000001FA6BFF0000-memory.dmp

Download

memory/2044-155-0x0000000001220000-0x0000000001223000-memory.dmp

Download

memory/2044-156-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/5040-162-0x0000000000E00000-0x0000000000E02000-memory.dmp

Download

memory/5040-163-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/5040-169-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/5040-170-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/5040-171-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/5040-172-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download

memory/5040-173-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

Download