qakbot | 7e0bb1837cc96c46850eb4c03c40fcb7a4338f8d655b76927a4d67f793233eb9

General

Target

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
Size

1.3MB
MD5

f9073d4ac3089ecc2c43b73b3818582e
SHA1

38813f19e54d28055b2cc4d7030cf608ca5d4c5a
SHA256

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92
SHA512

bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35
SSDEEP

24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2952-2-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/972-3-0x00000000020D0000-0x000000000211E000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-5-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/972-4-0x0000000002120000-0x0000000002173000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-9-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-10-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/972-12-0x0000000002120000-0x0000000002173000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-17-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-24-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/2952-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-25-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-27-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-37-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-38-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-39-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-40-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-41-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5
behavioral2/memory/5004-43-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 972 set thread context of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\a5272899 = e5b15cf3e014830f63f88098433ee7e465f05693ce8192cd44561ab0027bd5c7a59a5b419abc26314a27020bde1060ac3af69e23280e14eb123a6d9ee13f999df75d65db910460ab05a3453f1fd60627eb13b1390ba54ae7a9739ad5623cd36669	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\a5272899 = c7676c4d79923389b2f83a643fec635c50cf29aa204f017571ee636c814164818cad65409d836e5d386cfc24db67942b9d172bf1785b5b71977f6642d72cea393a8314fe663e05b6bf2083f62d64017da878cb8118ed5f6115c1b9368776ef7a2d4404e224aa31dcbe0e966397ee1d90e1eb908f8397e097bf8078a2a03877e6c5	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\f2883dd6 = a5a455acd6ef8f74a251a201755f06cec7fc4273bc38515ad19f995bd11720305b5c81f928bba61d1f94d608e152d945b799eba04208110e979a0ab01ab11f1c64cecb7ac02299bceeb34eff83bf7fe6dc75a2e74a1d6ccde4120b2204bcca502efa7609f3973914470e9ee06f9eca3415c224c0f8d7b5cf015e30778eedbe372e	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\3fa560cf = 652aa436d4837760ff034053a298202a264dede4eb2cca1a4ccd9d06a1a399b3b520af33a6c95cd9644109bde89d45056cc03d91ffca1be12f83f400fb9cf552b5	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\a4a0751e = 06cb7234aad5ba0c1f7f662ffa5c8f294f34474a6a603b792cf49f77f1d187334c237c9137b24734f421137ef2b0546b203eef6bf2e1b80f18bd0fb7db9c69bc6387a79945acd5e651a02131daa102885a	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\f30f6051 = 444710bee2dbf1c71ed7456fdd358db3e7e1126c808efb3325b19f30ec9b156ecf450644d74e7a92cc0e786222bd5055185fbe0568ae9bdb928495ebdf424d8c3e845e3612962b5865a99bd490378b150652ff91d0108b7311510679336c280bda617eff96cb2d69e11b4357faacead66b0a061eb966c9259e85a324386b4cff5ab00b5c94351c765505381cfb50a14a793c4b4100e0e29d0bb80402c9826a1e434b56fad8f4d37bbd1036c91fe3344fda6d4083887f5aff8477a82a5d90692e92	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\edc726fd = c535f81f23c63f25302de57bf90bbd2d6a8057fd57ccca3f1e724f62cff7d78d8acb73364a4b73f657fa85090a84a934efd42f7ef24f4eb69944d3f7938e482369	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\216d2663 = c650ec542f759a879db019ff247caf1dfe8fe363e79564d0338a3c052306f17b044e3bb9e0609d9bb068adda466fa53fc346cbb39cd23506a9cf0f1c8c792257c8	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\vdqqwadybc\3e223d48 = 67c95115175be6ce61b471dcd568467b5648d5ea2ca23867d848e8868bf37d80025fb2dc1e31e97d41815f3ddab61a8685163f89bff077d839f90f93049aba80dc71067b28dbc209e3df38f8db0792273e	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exewermgr.exe

pid	process
2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe
5004	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exefda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 2952	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2952 wrote to memory of 5004	2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 2952 wrote to memory of 5004	2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 2952 wrote to memory of 5004	2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 2952 wrote to memory of 5004	2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 2952 wrote to memory of 5004	2952	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
  "C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\System32\wermgr.exe
    C:\Windows\System32\wermgr.exe
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-3-0x00000000020D0000-0x000000000211E000-memory.dmp

Filesize
312KB

Download
memory/972-12-0x0000000002120000-0x0000000002173000-memory.dmp

Filesize
332KB

Download
memory/972-4-0x0000000002120000-0x0000000002173000-memory.dmp

Filesize
332KB

Download
memory/2952-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-10-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-9-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-1-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2952-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/5004-16-0x000001E6BCE00000-0x000001E6BCE02000-memory.dmp

Filesize
8KB

Download
memory/5004-24-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-17-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-25-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-27-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-37-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-38-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-39-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-40-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-41-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download
memory/5004-43-0x000001E6BCDD0000-0x000001E6BCE00000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads