qakbot | 285900f8031e55019ce49fb97edc2eda196fe233e84104dc68053779e75419dd

General

Target

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
Size

1.3MB
MD5

5fec958eac0d6cd761e99616b86f9cf2
SHA1

fe0515cb74a579b293b3ea2d2cd88b0192326455
SHA256

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699
SHA512

7cf78df279f4cf31fa763a7ddbaa70879c5e697adf9fac8cd4650b1e6454ad874a0e058da99a886620740bdd526eb4a8eabb1c9693e991b492a3d627bdcdbe6c
SSDEEP

24576:pH4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:GG8P8VcrlcwLXPpL8

Score

10^/10

qakbot bmw01 1706268333 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

bmw01

Campaign

1706268333

C2

116.202.110.87:443

77.73.39.175:32103

185.156.172.62:443

185.117.90.142:6882

Attributes

camp_date
2024-01-26 11:25:33 +0000 UTC

Signatures

Detect Qakbot Payload 26 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3040-5-0x00000000020E0000-0x000000000212E000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-4-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-7-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3040-6-0x0000000002150000-0x00000000021A3000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-3-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-2-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-8-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-9-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/3040-10-0x0000000002150000-0x00000000021A3000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-12-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-11-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-13-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-14-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-15-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-17-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-23-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-24-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/416-26-0x0000000140000000-0x0000000140030000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-25-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-27-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-37-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-38-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-39-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-41-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-40-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5
behavioral2/memory/860-43-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 3040 set thread context of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

Modifies registry class 10 IoCs

Processes:

wermgr.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\e6497274 = a6e9acc9f0cbaa06c07386c6a947995bee25656b9de26a01f686c901e5252af10f9355078ff6fef637623cc5ceaa32b69e9b210984be782652aac3fdf1b61ccf69bf10e0195791500127208dc7c80d0fde7e1763e281e4cc6403e9df5f78cfb72cb2dbb1b94c0cf385da92a4189feefbd455c21781fb65183e2eb581f9d9a64675	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\2ae372ea = 85529eaa950f0499414403f3bb2d9057cf1f809143bfa38711274206a68259db10f0a6c69a8e159639ff2ae2812eb8fb85d2e35cdd28dfe8d1061ebb6557da520d	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\f88134d8 = e77938233cfaf2de330f35688d92bec1f4846f94cc15cfb525f4429724067f62d78d5f797696eea38a6eb14c1fc78e526cd9e6dbf35232863b3e8c7b7b0c25717b4582112d9d22d393dd47b8f5e64984364e27a8c47c3145d5c18ff680a6e4594fa8bd8ed3846927333a896c7a943451849a87567bcdb1008ad475dc4a9d150ec78085d15106cef30cf46719968226bea0	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\35ac69c1 = 44550dfc4769d957f36e313b95dcbd0925fa4917a9e0cf6903caf47a8261d205c08ea218cb25f106db17ed0e247d01103f	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\f906695f = e77f877b65aa2d14cf0f7a7889230f90268077333c8f472dade95825367dbeccdc537342c3739dbee74da7850cb7b45b3c	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\342b3446 = 2588d232c569076e36429e585cb9825fee41fbe7a89a1b96b8e1670e54fa6251e8f105e43f5b9f4da036ea089d79aa10edf9712de54a871338a5cc511a0d49c33f13730beee016d55c7afb94d94835860c65247325bcee8533fb132d400ea0fcd051b17ef6c3453f00f91b08186585e0504d54766e2fab46575b24f61616e1a6dfe3b4c09a966720623b3a729c23a984ef	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\af2e2197 = 442b305a8ec5988a9e6bacad178f9ab17e8e2f18f9c8218d47f69e2572bb3b3b0f66cc789da920169e97243801fa2ace7863ede8b818fc5ce389a35d323734e2f8a78ea4812fb36c98083baaad27403f26	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\aea97c10 = 47929cbb7e652520fc58d1de5919480739e5ef115949beb0d17b73f7ef0d5c4291938ad300fcbfe6ed5c3d3c83d03edacf56f02cd92a358e98c6e4d2eb3428a634	wermgr.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo	wermgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\dfujxiqusfyigo\aea97c10 = 64fb85e233b1c7c8b3ef2ba88dcc054d06b2101cf96498d6f0177a735087f2ec09	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exewermgr.exe

pid	process
416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe
860	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exedfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe

description	pid	process	target process
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 3040 wrote to memory of 416	3040	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
PID 416 wrote to memory of 860	416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 416 wrote to memory of 860	416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 416 wrote to memory of 860	416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 416 wrote to memory of 860	416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe
PID 416 wrote to memory of 860	416	dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe	wermgr.exe

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe
"C:\Users\Admin\AppData\Local\Temp\dfe1abe2c591590f0f3b931aa439e966c380d5fdc6a9e74e6012f47f53eca699.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\System32\wermgr.exe
C:\Windows\System32\wermgr.exe
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-14-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-1-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-0-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-7-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-15-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-3-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-2-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-12-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-8-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-9-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-26-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-23-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-11-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-13-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/416-4-0x0000000140000000-0x0000000140030000-memory.dmp

Filesize
192KB

Download
memory/860-27-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-39-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-17-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-16-0x000001F2BBF60000-0x000001F2BBF62000-memory.dmp

Filesize
8KB

Download
memory/860-24-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-43-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-25-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-40-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-37-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-38-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/860-41-0x000001F2BBF30000-0x000001F2BBF60000-memory.dmp

Filesize
192KB

Download
memory/3040-6-0x0000000002150000-0x00000000021A3000-memory.dmp

Filesize
332KB

Download
memory/3040-5-0x00000000020E0000-0x000000000212E000-memory.dmp

Filesize
312KB

Download
memory/3040-10-0x0000000002150000-0x00000000021A3000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads