qakbot | cc9cda7c69f80fa63ea624f3d8850d4efd4c95397474b735a912592bb2b72d11

General

Target

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
Size

1.3MB
MD5

041f11543edf5591a8fb7b0037e3d115
SHA1

ee5fb2448d4437c2eaefdfb7cac13a0a2162a775
SHA256

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d
SHA512

3e3e5634cb560178ec75b2a74a92a9bbacedf53f046491ebf9e2d7849b1b1ea5327cf9e8e3cc2ffc3938ca12d6ab281ae466b4446c2b338fa35976ef6f5b83c4
SSDEEP

24576:6H4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:1G8P8VcrlcwLXPpL8

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 14 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2076-1-0x00000000020C0000-0x000000000210E000-memory.dmp	family_qakbot_v5
behavioral2/memory/2076-3-0x0000000002130000-0x0000000002183000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-4-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-5-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-9-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2076-10-0x0000000002130000-0x0000000002183000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/1576-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

description	pid	process	target process
PID 2076 set thread context of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

pid	process
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
1576	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

description	pid	process	target process
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
PID 2076 wrote to memory of 1576	2076	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe	2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe

C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
"C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe
"C:\Users\Admin\AppData\Local\Temp\2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-9-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/1576-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/2076-10-0x0000000002130000-0x0000000002183000-memory.dmp

Filesize
332KB

Download
memory/2076-1-0x00000000020C0000-0x000000000210E000-memory.dmp

Filesize
312KB

Download
memory/2076-3-0x0000000002130000-0x0000000002183000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads