qakbot | bcabc3f244e2bd0754c776aa430de16340149102f9d929cff643465976145ce4

General

Target

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
Size

1.3MB
MD5

f9073d4ac3089ecc2c43b73b3818582e
SHA1

38813f19e54d28055b2cc4d7030cf608ca5d4c5a
SHA256

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92
SHA512

bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35
SSDEEP

24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-6-0x0000000001B90000-0x0000000001BE3000-memory.dmp	family_qakbot_v5
behavioral1/memory/1728-3-0x0000000001B40000-0x0000000001B8E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-17-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-20-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/1728-22-0x0000000001B90000-0x0000000001BE3000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-21-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-24-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2276-25-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 1728 set thread context of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exefda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 1728 wrote to memory of 2276	1728	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2276 wrote to memory of 2748	2276	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	WerFault.exe
PID 2276 wrote to memory of 2748	2276	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	WerFault.exe
PID 2276 wrote to memory of 2748	2276	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
  "C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2276 -s 224
    3⤵
    PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-22-0x0000000001B90000-0x0000000001BE3000-memory.dmp

Filesize
332KB

Download
memory/1728-3-0x0000000001B40000-0x0000000001B8E000-memory.dmp

Filesize
312KB

Download
memory/1728-6-0x0000000001B90000-0x0000000001BE3000-memory.dmp

Filesize
332KB

Download
memory/2276-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-17-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-21-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-20-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-24-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2276-25-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads