qakbot | f673f0789fcfa61d30414464b763356e2d65ef07a596ebed4a615cd512557721

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 13:21

Target

12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll
Size

898KB
MD5

88bbf2a743baaf81f7a312be61f90d76
SHA1

3719aabc29d5eb58d5d2d2a37066047c67bfc2c6
SHA256

12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305
SHA512

b01f955eb5f840e01f1f65d5f19c0963e155b1f8d03b4e0720eccbd397cc9aee9a19a63000719e3cf8f580573a335bd61f39fe1261f44e1d5371a9c695b60b70
SSDEEP

24576:qTm4c0TXhxdmVQGn88R7XM3Ljluc9KEaJqCjh0LmK8:6jP8Q13LjluSrCj+q/

Score

10^/10

Family

qakbot

Botnet

tchk07

Campaign

1702975817

116.203.56.11:443

109.107.181.8:443

Attributes

Detect Qakbot Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2972-0-0x00000000001E0000-0x000000000020F000-memory.dmp	family_qakbot_v5
behavioral1/memory/2972-5-0x00000000001B0000-0x00000000001DD000-memory.dmp	family_qakbot_v5
behavioral1/memory/2972-4-0x0000000000210000-0x000000000023E000-memory.dmp	family_qakbot_v5

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2972 rundll32.exe

pid	process
2972	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2972 wrote to memory of 2548	2972	rundll32.exe	wermgr.exe
PID 2972 wrote to memory of 2548	2972	rundll32.exe	wermgr.exe
PID 2972 wrote to memory of 2548	2972	rundll32.exe	wermgr.exe
PID 2972 wrote to memory of 2548	2972	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12094a47a9659b1c2f7c5b36e21d2b0145c9e7b2e79845a437508efa96e5f305.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\wermgr.exe
  C:\Windows\System32\wermgr.exe
  2⤵
  PID:2548

memory/2548-9-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/2972-0-0x00000000001E0000-0x000000000020F000-memory.dmp

Filesize
188KB

Download
memory/2972-5-0x00000000001B0000-0x00000000001DD000-memory.dmp

Filesize
180KB

Download
memory/2972-4-0x0000000000210000-0x000000000023E000-memory.dmp

Filesize
184KB

Download