qakbot | 38599e13fad348178a4835230e1ab11e8bfeadd6b71914674a49ce8d67e758b5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7.dll
Size

271KB
MD5

a88f4c170e11eda9a789765001a84fb1
SHA1

b274da255232e48ab19e9b478f29ffd54f885a76
SHA256

ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7
SHA512

f5cd24cfd484d0ab54b7b0d0115005ab808d4bdde446380a2d2e9ab5a3f29265152e9139ba79fe8844be658afc7d41641ba71fa4f0fe050db4315d1055c3cf70
SSDEEP

6144:7pkLOv3+LLDCtR2GxMJ1qeCIHU5aSFRFwmpm4+8S197/vznolZVESTlZV:GLeY6RxM7qhI05Bzwm0N9DvLGtJb

Score

10^/10

qakbot tr02 1606301054 banker discovery stealer trojan

Malware Config

Extracted

Family

qakbot

Version

401.29

Botnet

tr02

Campaign

1606301054

59.98.96.143:443

86.122.248.164:2222

101.185.175.169:2222

71.187.170.235:443

92.59.35.196:2222

188.52.193.110:995

90.175.88.99:2222

37.107.111.46:995

96.237.141.134:995

2.50.143.154:2078

109.205.204.229:2222

90.101.62.189:2222

41.228.220.155:443

190.128.215.174:443

188.26.243.119:443

79.113.247.80:443

82.76.47.211:443

73.248.120.240:443

72.36.59.46:2222

74.129.26.119:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot family
qakbot
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2396	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2128 wrote to memory of 2396	2128	regsvr32.exe	30
PID 2396 wrote to memory of 1960	2396	regsvr32.exe	31
PID 2396 wrote to memory of 1960	2396	regsvr32.exe	31
PID 2396 wrote to memory of 1960	2396	regsvr32.exe	31
PID 2396 wrote to memory of 1960	2396	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba25af3aa1f14cd574b5f8d43867a0be53d2df9f6fe37116da6dd05446296fb7.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 532
    3⤵
    - Program crash
    PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x0000000000150000-0x00000000001A3000-memory.dmp

Filesize
332KB

Download
memory/2396-1-0x0000000000151000-0x000000000015F000-memory.dmp

Filesize
56KB

Download
memory/2396-2-0x0000000000150000-0x00000000001A3000-memory.dmp

Filesize
332KB

Download