qakbot | 78d7715bfea3e635666e19e58a6f6015e8399a9c706e3c3b5f25161fef41ce38

General

Target

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
Size

1.3MB
MD5

5fec958eac0d6cd761e99616b86f9cf2
SHA1

fe0515cb74a579b293b3ea2d2cd88b0192326455
SHA256

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699
SHA512

7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c
SSDEEP

24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2092-2-0x0000000000420000-0x000000000046E000-memory.dmp	family_qakbot_v5
behavioral1/memory/2092-4-0x0000000000470000-0x00000000004C3000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-17-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-20-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2092-21-0x0000000000470000-0x00000000004C3000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-22-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-24-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral1/memory/2356-25-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 2092 set thread context of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2092 wrote to memory of 2356	2092	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 2356 wrote to memory of 2676	2356	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	WerFault.exe
PID 2356 wrote to memory of 2676	2356	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	WerFault.exe
PID 2356 wrote to memory of 2676	2356	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2356 -s 224
3⤵
PID:2676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-21-0x0000000000470000-0x00000000004C3000-memory.dmp

Filesize
332KB

Download
memory/2092-4-0x0000000000470000-0x00000000004C3000-memory.dmp

Filesize
332KB

Download
memory/2092-2-0x0000000000420000-0x000000000046E000-memory.dmp

Filesize
312KB

Download
memory/2356-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-17-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-22-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-20-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-24-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2356-25-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads