qakbot | bcabc3f244e2bd0754c776aa430de16340149102f9d929cff643465976145ce4

General

Target

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
Size

1.3MB
MD5

f9073d4ac3089ecc2c43b73b3818582e
SHA1

38813f19e54d28055b2cc4d7030cf608ca5d4c5a
SHA256

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92
SHA512

bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35
SSDEEP

24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/972-0-0x0000000001FD0000-0x000000000201E000-memory.dmp	family_qakbot_v5
behavioral2/memory/972-2-0x0000000002020000-0x0000000002073000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-4-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-5-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-10-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/972-9-0x0000000002020000-0x0000000002073000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-17-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-24-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-25-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4008-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-27-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-37-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-39-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-38-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-40-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-41-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5
behavioral2/memory/540-43-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 972 set thread context of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\17280635 = 45639295bbcf05a446a72a044b0b7bc6b355bb44f5f174d9cc8ff39f299527e3fbe04f761ab7a5b42ff46cc828fc606621a3ebdb0745c521fb652e6801860de88ce3bd2fdc2a725b536730e86b9182b21400005b7e261347066564a77964ef72ac5dfdd9b896a19725c0b615023b58acd2	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\8c2d13e4 = 84b20580bd0e7bb3c22b7ec3a11752fa98d9aba190c5a6c62e25343e2414ce7bb80c64c66e07688525838734bbc698e3e429e5001602e0599ed5a23e3ff129008e	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\4087137a = a5dea1d2c6a7b5dd6fc47b01f04697da2c186b82ca325c60f9c358fa690bc2eb0e1debe9e985d79c26589ea94754573db424cf1c839866c0a3ff1be7e36e577b00e589c3aaee83c0b53ef5b0e44a20944dbc4615acd47eb39430a08f64c06a30601558eef108730d457e08e9d431c2fe8ac5a3f4bb40e92268df0ad08b8b238b33	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\8daa4e63 = 47076daac9ce27ef0c5c53c7eb38b8997286b8af01244f1e558ed07bc136548d1389f8ed4a1188f4c0934c6dd292b3b91e1172b22bff82b4f2675d8a57d97f3a31ee65d05b87f6fd68f162e22cdb26a828b59ba60ee837d85855a3d521b4effe2a	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\17280635 = 066d8b7e962a4330ffe9429a02e7c9db042969661e3f2d95988f4911820447a078c0b06a19401b965d73466ad9d3d1999171b0cb216c797789cc1ae3111915dd3b5597a924a40a7c6f37911b7717979bf571d97ff18ea10c8585eea5a3c79ac72794b34faea58b45dec271138b84e5902f148f3fa6ee51c2a23fab6e97fa85be08	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\41004efd = e5bbbb0ca64fac9e8927d6c4b339a1bb53e9664528441b99ca55d57ee683e128488a952b46b525bd7841d533d2441b69e240214ebd69b5990ff2f12a9f3ec24c3d12578014a56e59989cd2c4ecdf6f9ea0c9addaab2b7be772d9c349ba2dcd03179b14019dbc0289ecea113cf2781f2167fb29a12ad0a37a2fa0781f3fcdc700bdb24b7fb4a0c9fd2d1b41ab820c94e46bc6f22803e49b2d119786cba1a663570c0f9084cca856c84d536f04742ad51928c36233b3664054f2708de255902a05be	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\5fc80851 = 87f77192b6efb3855019c354d1b57c186e598fdea0cbe716da5b761a8a2ef82836f041bca15228a5c359ef6c22128ea1393bc86fc888c37533abc694fb585be01cab3d4abf4d151610c5a955c3566eabf8	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\936208cf = a7b3decb9414cd75f6a72f90c27302862540b40511045b47056d0f64a8cfc765463a90b76267dc5ab08ec884de6fc1b5afcafdb592f35f0e5a245a9aee6fd647d97ec3999a4cf4045b0a9c3478d3fcabf92f15b80c5845460ce6da0224569cb0a2209f06e99ef23e5e8600ce117e463f9814adaf9c2270c385a0c84f6f9f200e02	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\owuwbbihuda\16af5bb2 = 87edb416260f8f87107e4b60addcb57a1a55c223fa3d829cd576cec889b1de70ee76198be080774cdd379bd783d6c58937f46a786ca6c6dbdba35e32f37fda42805d2e732ace50d904205ffde7327a82179dcc0ba410489d0b054db00601ebc41c	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exewermgr.exe

pid	process
4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe
540	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exefda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 972 wrote to memory of 4008	972	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 4008 wrote to memory of 540	4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4008 wrote to memory of 540	4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4008 wrote to memory of 540	4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4008 wrote to memory of 540	4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4008 wrote to memory of 540	4008	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-39-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-27-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-16-0x000001C27D7E0000-0x000001C27D7E2000-memory.dmp

Filesize
8KB

Download
memory/540-41-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-40-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-38-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-43-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-17-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-24-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-25-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/540-37-0x000001C27D7B0000-0x000001C27D7E0000-memory.dmp

Filesize
192KB

Download
memory/972-9-0x0000000002020000-0x0000000002073000-memory.dmp

Filesize
332KB

Download
memory/972-0-0x0000000001FD0000-0x000000000201E000-memory.dmp

Filesize
312KB

Download
memory/972-2-0x0000000002020000-0x0000000002073000-memory.dmp

Filesize
332KB

Download
memory/4008-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-10-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-3-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4008-1-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads