qakbot | eae162906764fde991acf700bf008d3417cf9676e42d8a0374e93d0fbe17f34a

General

Target

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
Size

1.3MB
MD5

f9073d4ac3089ecc2c43b73b3818582e
SHA1

38813f19e54d28055b2cc4d7030cf608ca5d4c5a
SHA256

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92
SHA512

bc52575d876e84c7b9b92590dc9168785021da7ce9c53e81421b307cb6de157be3e88f19aee095b0ecc6bf57f7ed02da0df1198b71ba6c292ec37d3ad50b7d35
SSDEEP

24576:bH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLFg:cG8P8VcrlcwLXPpL6

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2548-3-0x0000000001FE0000-0x000000000202E000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-2-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-9-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2548-10-0x0000000002030000-0x0000000002083000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-6-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-5-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/2548-4-0x0000000002030000-0x0000000002083000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-17-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-24-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4360-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-28-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-25-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-37-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-38-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-40-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-39-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-41-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5
behavioral2/memory/4872-43-0x000001F881B60000-0x000001F881B90000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 2548 set thread context of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\77ae6911 = 447ddd3282dba8a432d71c733b0cd153d2d39f1e0456dbd9ea9342641908cdb7035078d20cdcf3fa25a4c90241975fbf1aa5d1b37f2301bb6acd49a2a8876705ea97e2444e03056d7dce47b7c2e8bed0ed	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\218621d9 = 65a729d1affee30ff1bc3a081edb5e937e1232d38737d455462a81522d67bf8a450d091a366d8983bf1500cf41290922a9ee9ddcf3a5e596f40a684cf9e29a4b3380c03a89058feeba393c8ddbe6b6e0700b6357fe369feb6dda153dd45e246bb30948cfa89e57209d57fb3b13a6d64eb296bd673c9f855e48dc4367877e507efb6566fd194fa71682044d46a1c2cc1d887e8517537c18a4b82bcb5f9fdaa4590ce25659a476e6a495919997bd309cb334	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\3f4e6775 = 87bfc597dcde43dd13bbc7f8710bb8cf117b665eac0389263f35fa6d087134d574b77798e38705a69245a87a9302abf2dab60862766910d23a8f1dc8bf2ab70a5b142a1951a6231e4ad85ee0e90f8669965ca489dc92951d94088e15b61a1ddf41c65acc4cf67f65b966247ec6c57a66f63acc7d07ab2cc38ccd31d11a08bb7e07	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\f3e467eb = 07a40764a9e9ca6ed145b47bfe109654f286a69d38fd30277cba20e7ffc1af207d52930662c05db6f063a59bd6b9121a8a307732fb7cf4a17077407fb3cbc36494f0c2b91997aef0975ad7635660e3a5b7d10f3f01fb980ad4c2e5f1063ef4f6af	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\ecab7cc0 = 643e38e6a38d9ca64eedc45f950cf874b9f8b346e913e756c9f787808fe2098894447e95413fca80c30625e3a212108e02	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\20017c5e = 67193d6de05da8af602dcef4f5e5939629f94ea9d6922dd492c4b3fb44e625a073bc69cc056bd1600035e991ad9201fc078bb3077c349785adf764682a61fa1a83	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\ed2c2147 = 67dcc405bcc88b9364d6369680e39d61d40474e301cbe668e97146d532f8b9445501a0fa61e4a7d4cf02776036b0d0357e61ba568bc1941c33a592293e491097c8e0cbe5787d910b01bf34baad503f77cdf59a9f78a6a29b9e24f27876f221b8ef	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\76293496 = 27acfdb288f57bfb42c1ba815f7ccdb4220a2d1b2250de3e6e56c688f55ee2ce45b6fe3eb40653d5672c39ed14127dd4adec7e615e0c2f7b0de8051afd701826bfc9127dbe9d5342edf403e024c65e9a61	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\mkegmhgtzbp\77ae6911 = 66f47643feee0bc3b9deb1ea2d322e391cb60821a7aa2853024d2fde78697e5a315636f5da33610c9e5b457367e446210c1d52932bcf6815d4cb4bb2ee047a626aeb0f555f2414d1f5884c2b8bd78b3ec75ffe85ebe83f1a67edaf0ac80910fe69d0d799480f5b39a2dfa8f98f4ad46a90	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exewermgr.exe

pid	process
4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe
4872	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exefda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe

description	pid	process	target process
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 2548 wrote to memory of 4360	2548	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
PID 4360 wrote to memory of 4872	4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4360 wrote to memory of 4872	4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4360 wrote to memory of 4872	4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4360 wrote to memory of 4872	4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe
PID 4360 wrote to memory of 4872	4360	fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe
"C:\Users\Admin\AppData\Local\Temp\fda2abd24764809fb36d4d2ee7ab5f6e8c06381fe6d9bb191bde62411c96ba92.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-10-0x0000000002030000-0x0000000002083000-memory.dmp

Filesize
332KB

Download
memory/2548-3-0x0000000001FE0000-0x000000000202E000-memory.dmp

Filesize
312KB

Download
memory/2548-4-0x0000000002030000-0x0000000002083000-memory.dmp

Filesize
332KB

Download
memory/4360-6-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-9-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-5-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-1-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4360-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/4872-17-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-24-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-16-0x000001F881B90000-0x000001F881B92000-memory.dmp

Filesize
8KB

Download
memory/4872-28-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-25-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-37-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-38-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-40-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-39-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-41-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download
memory/4872-43-0x000001F881B60000-0x000001F881B90000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads