qakbot | 110423a9555f7aba13483288abdb3badc6194dc01f825bfe1be174d506625efb

General

Target

third_carved_dll.dll
Size

166KB
MD5

07dfe6aed5e353c8d4cc0ab026c63e3e
SHA1

29fe5ec300aa7e3b5124a223eafaa0c7df39db56
SHA256

110423a9555f7aba13483288abdb3badc6194dc01f825bfe1be174d506625efb
SHA512

7d165bc271fde6a07d65400f4175eaa12710bb4219cb24085b67cfa7559352df9d7dd08814a42f2b17d1b888e7b43093a8d6ad630eb0eb6bfe97014a6ef0bb8a
SSDEEP

3072:9ixYRIgVFK9cJx2I87ZMGCDaZqZu9E/gVAE/dxwtJBdw:9ixYVVQ9G2I8ZMGjZqY9EcAWUB6

Score

10^/10

qakbot tchk06 1702463600 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

tchk06

Campaign

1702463600

C2

45.138.74.191:443

65.108.218.24:443

Attributes

camp_date
2023-12-13 10:33:20 +0000 UTC

Signatures

Detect Qakbot Payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2076-1-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-7-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-20-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-21-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-22-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-23-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-24-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2076-27-0x0000000000060000-0x000000000008E000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Modifies registry class 12 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\dbe934de = e52cb4f0bfcf80e6dbefadb0764bb8fe6d86a644c48734fc1b7326b1821b256acd2a2d6fe4f3315b624fbcd22fe5e8c19d	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\cfe47b6b = e460fdbc224c61b0ddb4723e55d61d6c0c3743efdf4453153af2f4e165ff83f9caf2f1ece4d45121fcebb9ce95077c3e92fd9f4c98743079842996a271f8de4c49af9b1d4d677ec442e8cf143ecd09ca44	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\c4a62ff5 = 25c6697d47640bcac3b466c95ed99152da42fea71eca7fac9bac922dc792bbb6dc09271ad4930fbe040e470fb6e6de1a113e02be68adcb31e595da139f750d406980917d3f37eee6efc7d6985fb4fd62148df898975fde7758c34dddf91a7c9fe9fc0c9d2be8a09681d5593b7173dacfaabc2785db0389b6d1c89b164a41ef0466	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\80c2f6b = 04c7c00634ae02b315b2993376f438ddd768f1e4b1f88cf3ff7f820e40a3493b066482b4dbee7c1063d358822fca2247a69ec557b6604e5e0acee97fd43bc7c210	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\c5217272 = a7ba5864e8e55ac5f2344e0ca8219898a436e37fd96f01a3b9aca1dae120c6a36c7a7177f330031148eb173f84bae1565f53efc49c2db939a9d1863c01257bccec8fd620cf1e60a8d88264d61f23b89afb19b02062b7a21684c1a7e8bc5ea1cd92f98cf1235fb1e40e38d25061762ec540	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\5e2467a3 = c70235dcac9756216898700eeb4137f30b862267d3642704a9e7e81036e74837bbf7dae46dc912dae728532b8badba37fe57767c0aee6e2793087b1594a0d5826a5d4b9be421aee47c6d4e90bf13d614404737f5fbff93d3908054161dbb40f6ca4dff69515c0a8126717d218944bb1b44	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\98b72ec = a584bfab24b1ec582dc683916dba0808fbb65fd84abffeaa79510756e50d3b4b0a08492a4851d39c36ef4e27809ee49379eccbaeecb3146dc5cf55b265c09b61923891095ced271c31f8d164954ba98208202f57aaca2d3fea8b3c9d66eb6dccda6e2004c5c00b06dd0e513823e626cd6a7ee5f2d527a3cc21c4d66169d3ca9f237f45229a875631a2d2974ac5c64d989fc8b824030f6c40e52b4698cf7979af85533607a232793244a2742c46c84825e2530666397cf0505adc21dc4f67d79f22863a2b1e0e7dacce3d8d3545ec4c08a5	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\5fa33a24 = 65289035c8c0a01b365cedf1fc0914932723d0fb27fc834dcbfe748105c9bf0874213d00626700065325b9cc56e81f2ba352ab06988e94aa67dd0c382b4e3f58aa	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\60ba51f5 = 857742b80b7a8639cabb8931539c65659c4d3e9028c949cde64e823936bb420add492a138b8cdf6970ce459613e39f2bcf11120832c752d0685740dd65f10fd21821033fcc19aa8bc439878d658f03bb65eff0b76770806363443559da38fe3c82729b2cedff4f3a57279bec936c46c613	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\5fa33a24 = c462c0b90debc119d39d1ed80597c038e880e58580f609c1c9d69824dca1872e41b80bd9221eede7169df31b3db8c3b9b0	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jdwjicdelouimui\17433440 = 442a804c6683b7028a0c6f00540f5918b08df1f951b8c96283861148f36a646cc50a01d45abb5a1466e2866dd07a9c06dd633d46c9aa8cdd504abc0a338da7bfea	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
2860	rundll32.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe
2076	wermgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe
PID 2860 wrote to memory of 2076	2860	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\third_carved_dll.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/2076-1-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-7-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-20-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-21-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-22-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-23-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-24-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download
memory/2076-27-0x0000000000060000-0x000000000008E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads