qakbot | 20532cbe261d656f0e8a231aa19d5bef7de00fa9fcdb38dfc253ec45c91f3009

General

Target

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
Size

1.3MB
MD5

5fec958eac0d6cd761e99616b86f9cf2
SHA1

fe0515cb74a579b293b3ea2d2cd88b0192326455
SHA256

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699
SHA512

7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c
SSDEEP

24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4804-1-0x0000000001FE0000-0x000000000202E000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-4-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4804-3-0x0000000002050000-0x00000000020A3000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-5-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-9-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4804-11-0x0000000002050000-0x00000000020A3000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-10-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-17-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-24-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/2268-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-25-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-28-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-37-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-38-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-39-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-40-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-41-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5
behavioral2/memory/3244-43-0x000001E61F4F0000-0x000001E61F520000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 4804 set thread context of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\cf82c43f = 65a9ae25704bfafd6bdd920a095c8545f5102ff5490095c62e39053bdfd3f8514fb090fd5d350ab41fe454a9bf17d27a17476a7cfeb4a000ab55a9011b9039a5c86c274ac054ffa071788061ad01b4d6039c195c9d64bcb5964ae45b51d7bc7bb3d890c580f31e946029643f0dbf195f39c379524c293ba66710341b4aa81c1c05048955d56f0b3988e8664dc5591adc6965315fec0c7f8f1158c990e39c3d464bde339cce8fe3434b11f9eb4c8d219ff65d1326da52dd07c71df8564aea10f418	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\d14a8293 = e7e70fc11fc3da9978412a9a71189c345f352a6671d8f3d78af138538c8a3fd4391ebdec7cee7fd3765f2824c9e8536f9b385cd8fb0b4ecbc734dff656544a9eddf869b8b7080e26d42383cf959e0f53bc3a6ffe062e2805423164989fb95217ec995c35f90944fc0bd19a4e81effeb9b3	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\2af9926 = 845bb41f6d913909c8bef96705e13d9d6635250b37e2c902225f46b900aba0b8e7f532987d0009b56610d7b5d4780fb011c7ae21141d15fc52a3b14fcb07ae4b93750c531b0bf45dd2d2a911974d7cf92b89fe6a800a5815364c637d353b94a6b0d70d42e6b6032ece2d7dfc39c2af1b2f1c43714ed1b0e4042d8960e273c9778e9059a4fa62788185e84d3450cec16008	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\328c4a1 = 06c7cd6bb5ac7e29bb49288eb4664f8a7bd42e37fc95e827521edcae1efd8dfa65ea68e9c475b115481e4fdfd7b9412d704a0f4d0a5103eacdd1376c9b2bb6cfb03543da5c9f5f8230a54c5477d7d5e698d197b5f70d247907e37258ea2c8c6154	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\982dd170 = 267589ef374af4e3b0139d344fea5953b9295a431de6c0e0ae9fba0f62b7520873dfa30ace2e155b0ab03e806383666d3606ac95e132566b79e0cc7eed880a95ec938baef4b9a3ee981745f99ec416df39	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\99aa8cf7 = 468f2a97b22b8fcb2aa402f690417954ba085479e26681d55b568b8211de236abb05ceb36465ae35eb5e8c6ca363f0b126cd0265b79b7216ac4ed463ee00a8690f92a92cc7726f8af4d7d1daf6dc75aa30	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\1de0820d = 464b17a3ad340278865e92a78837e6865bc7a4043409af38fa5132f96b5d70532d3dd7d5eb4ecf2ce4ad0b691b01dcbe695f8821d18e9c36c310a0eafc7fa38b4de8b0f781043ca81938d268c1e89900d085c6a49db5840d64bc47785192704acacf075573e500411fbcda3d7ec23c32c6	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\ce0599b8 = a6dab6b1d0effd8ddde36ffee4b95b6f40be15aabfdcdbddf9198720935885a93a3cd03bd1f36437d663b0b548a04c991f261ead429059cef311c083ce3a63183cb52923978a3d31f3e5e603a8d8afbf70651c596a42ce408f440f54e5c089cd36	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\lxkbhzyajk\99aa8cf7 = c6e8dcd072237f98b8851991161bbb358105feabb07de323c82623498227069d26310747aac15def74c6c9651347f676c513bae5e5496e4faf0182f467fabd3ed9727ba64baefc390208c0f47d826c39f5b342772497788a7da88922df3b12fd95	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exewermgr.exe

pid	process
2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe
3244	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4804 wrote to memory of 2268	4804	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2268 wrote to memory of 3244	2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 2268 wrote to memory of 3244	2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 2268 wrote to memory of 3244	2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 2268 wrote to memory of 3244	2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 2268 wrote to memory of 3244	2268	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
  "C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\wermgr.exe
    C:\Windows\System32\wermgr.exe
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-10-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-9-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2268-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/3244-28-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-39-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-16-0x000001E61F520000-0x000001E61F522000-memory.dmp

Filesize
8KB

Download
memory/3244-17-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-24-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-43-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-25-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-41-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-37-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-38-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/3244-40-0x000001E61F4F0000-0x000001E61F520000-memory.dmp

Filesize
192KB

Download
memory/4804-3-0x0000000002050000-0x00000000020A3000-memory.dmp

Filesize
332KB

Download
memory/4804-1-0x0000000001FE0000-0x000000000202E000-memory.dmp

Filesize
312KB

Download
memory/4804-11-0x0000000002050000-0x00000000020A3000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads