qakbot | 78d7715bfea3e635666e19e58a6f6015e8399a9c706e3c3b5f25161fef41ce38

General

Target

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
Size

1.3MB
MD5

5fec958eac0d6cd761e99616b86f9cf2
SHA1

fe0515cb74a579b293b3ea2d2cd88b0192326455
SHA256

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699
SHA512

7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c
SSDEEP

24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4732-2-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3464-3-0x0000000001FC0000-0x000000000200E000-memory.dmp	family_qakbot_v5
behavioral2/memory/3464-5-0x0000000002010000-0x0000000002063000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-4-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-10-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3464-9-0x0000000002010000-0x0000000002063000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-17-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-24-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-25-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-27-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4732-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-38-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-37-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-39-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-40-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-41-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5
behavioral2/memory/4348-43-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 3464 set thread context of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\49bedb1e = e63a16e6a495b5b6dcbeb3c23c0ac9cb6fd2482fd0dc15e92b2cd3760e583bcf9c6f9cbda462d2ece6f4e3838c5d23c23c76a91c8655e41f9808c03d61cf98a445a8c0b342fed96af71596fd9174aa3e95	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\9a5bc0ab = 44884a74ee2f8ad24b9750184196433fa11c895f1a1234790059838b0d6916cf67f75062cb57b724d5ff9e73822288f8047ea83231d67c7bd7082123566d676323027780c8b1ab4d8552c546884592e0eb04f4eaae440ee4c8d52ab83082b2a3e0792430f8bf2ce41bbe4ffba8ed8700d4	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\57769db2 = 85e525d1ef262f1c09e56d333803c4abe8a125ad62bb712f9a1aafde82c09784d551446b9b664ae21512a7d57717c33ceb981b927e2fcd0faed77afbc9b7a45a7f	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\cdf4d5e4 = 6529383b703eb6efb3caac1f57f69f700e8fdfb48946034e619641bebd2b2000deeb9efff5bc3867a741268fee1c068b193e61daf0005e36d7e77fa430adf5e6272670bbc0f7a68e06d4f30c800c81aa92	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\cdf4d5e4 = e6c23541c6af43c79050db377c4bfa01126e51ccc5866695c9ce83e86d5a200f1cdd8f82fabb512390bb336d0b8dbb6a27f003390bb3771275b750dc16c7054531	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\8514db80 = a7cf9c5b0f28792c97b0c40fc7a9888fd7bf84735af990086cc702492c3e53388318bad009f8c50f94045fa30b6a4df1ad295aae0553ab0c2dbc15163b5fcf5e70ca0e76a1cbe916b5491726c21d5cd77d	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\56f1c035 = e7cd861d1aa327cccdd69e37bb2c57f7ad467f96fbeab1c8167a626fc638b7232636b18294e1a2fa66d0aa77524871a38d038cbabbeb88422d4de592d65a4377eaeb02defb5739fe9f6cc30e4c79fe1825eb1c6f81d0f4fda82ccbae534c5b9674f87607a44915f85ffd42967e51e9c463	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\cc738863 = 648b7acb44d30f992c5cd3ac89dc8501972bbd9c2ba2b2fe2d91c3843f1336845cfcf0c0401ed7349f74509d83d295820301cda84ce2d77a90c3f7ff72155aa62f	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\hjpngoioa\9bdc9d2c = 44ed4119207206b5bfd06be13220281d91cc3209f2b384dd4ed21f743d34662e2093b744ccd5ce61a7c706d634393c9ed901c096f19553a706f655ed6b0013d5d10669f83f7efcf46b4f20b6655fead25ea43772bb16d0f90d57f26529d1764597108d7028be330f7d82ea02188780242b287ff5c3cc9eb2f708684905721e4596a22212073cfca87f2c54077572e38f315ca65bdd16297898a9fd2cb422a7419c62cfe1d844122f3d11cc5266bd44fc7539beefd662690f62603c6178d1ae24cf	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exewermgr.exe

pid	process
4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3464 wrote to memory of 4732	3464	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 4732 wrote to memory of 4348	4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 4732 wrote to memory of 4348	4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 4732 wrote to memory of 4348	4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 4732 wrote to memory of 4348	4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 4732 wrote to memory of 4348	4732	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3464-3-0x0000000001FC0000-0x000000000200E000-memory.dmp

Filesize
312KB

Download
memory/3464-9-0x0000000002010000-0x0000000002063000-memory.dmp

Filesize
332KB

Download
memory/3464-5-0x0000000002010000-0x0000000002063000-memory.dmp

Filesize
332KB

Download
memory/4348-39-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-41-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-40-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-16-0x000001ECA31A0000-0x000001ECA31A2000-memory.dmp

Filesize
8KB

Download
memory/4348-37-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-38-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-27-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-43-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-25-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-24-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4348-17-0x000001ECA3170000-0x000001ECA31A0000-memory.dmp

Filesize
192KB

Download
memory/4732-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-10-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4732-1-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads