qakbot | 1cabd00e7dfb01e346b6d4478c5dfbcda2da1ffd3526baf91c1f4dc28f7d63b3

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe
Size

4.2MB
MD5

6655347cd176e076ac8c8e509841f1fb
SHA1

2bf60b4709e1e653ad5427761ba70c7b6c22b8ba
SHA256

f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2
SHA512

ca18ce0c69062b42d1fe4b1c563b64b3cc55eb8601a6caef4eb9a246442b152b553df08e7d6cbb200cdf6095205dd8d8c5db8d3923cfe4cdce8e109efab17d5a
SSDEEP

98304:YdPQzF3R/e/hh6FZFLOAkGkzdnEVomFHKnP:YA3AYFZFLOyomFHKnP

Score

10^/10

qakbot bmw02 1706788306 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw02

Campaign

1706788306

62.204.41.234:2222

31.210.173.10:443

185.113.8.123:443

Attributes

camp_date
2024-02-01 11:51:46 +0000 UTC

Signatures

Detect Qakbot Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2588-3-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-2-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-4-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-5-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-6-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-7-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5
behavioral1/memory/2588-9-0x0000000001B80000-0x0000000001BDB000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe

pid	process
2588	f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe
2588	f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe
2588	f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe

pid process

2588 f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe

C:\Users\Admin\AppData\Local\Temp\f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe
"C:\Users\Admin\AppData\Local\Temp\f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-0-0x000000013FEC0000-0x00000001402F6000-memory.dmp

Filesize
4.2MB

Download
memory/2588-3-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-2-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-4-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-5-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-6-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-7-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/2588-8-0x000000013FEC0000-0x00000001402F6000-memory.dmp

Filesize
4.2MB

Download
memory/2588-9-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download