qakbot | a846cc8bc2c20dac4e2d96c8f7529d012c725d8ba80651696c9c6a56445a2c39

Analysis

max time kernel
138s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8635f01a85a808eb91d5021a0d35310f.dll
Size

327KB
MD5

8635f01a85a808eb91d5021a0d35310f
SHA1

a47c97327bc124b65de4cd080968888f09a41352
SHA256

a846cc8bc2c20dac4e2d96c8f7529d012c725d8ba80651696c9c6a56445a2c39
SHA512

53f0c2a21b3b854b56253d4932964d7e369f6f1868e14bfc4e47c6fa2e2795468ffb17c6c4d41295d327eb2d4a13178ca4c064ef5132be79e6a4e5a7a5aa1b95
SSDEEP

6144:R60vBQcV0PPspp3Ke/QVCY9/Ob9ho+JVxfTPAKxu9755fu2v4ibqXtWXC11:R7A8TJPNPp84NibIt11

Score

10^/10

qakbot tr 1632730751 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.343

Botnet

Campaign

1632730751

95.77.223.148:443

47.22.148.6:443

89.101.97.139:443

27.223.92.142:995

120.151.47.189:443

136.232.34.70:443

120.150.218.241:995

185.250.148.74:443

181.118.183.94:443

140.82.49.12:443

67.165.206.193:993

103.148.120.144:443

71.74.12.34:443

76.25.142.196:443

73.151.236.31:443

173.21.10.71:2222

75.188.35.168:443

2.178.88.145:61202

71.80.168.245:443

45.46.53.140:2222

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2168 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

660 regsvr32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

660 regsvr32.exe

pid	process
2168	schtasks.exe

pid	process
660	regsvr32.exe

pid	process
660	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 2172 wrote to memory of 660	2172	regsvr32.exe	regsvr32.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 660 wrote to memory of 2448	660	regsvr32.exe	explorer.exe
PID 2448 wrote to memory of 2168	2448	explorer.exe	schtasks.exe
PID 2448 wrote to memory of 2168	2448	explorer.exe	schtasks.exe
PID 2448 wrote to memory of 2168	2448	explorer.exe	schtasks.exe
PID 2448 wrote to memory of 2168	2448	explorer.exe	schtasks.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8635f01a85a808eb91d5021a0d35310f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8635f01a85a808eb91d5021a0d35310f.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn sftzatehkk /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\8635f01a85a808eb91d5021a0d35310f.dll\"" /SC ONCE /Z /ST 23:58 /ET 24:10
4⤵
- Creates scheduled task(s)
PID:2168

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-0-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/660-1-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/660-5-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download
memory/2448-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/2448-4-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2448-8-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2448-9-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2448-10-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download
memory/2448-12-0x0000000000320000-0x0000000000341000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads