qakbot | 61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
Size

454KB
MD5

4c73af70c1c54b55973adcfedc031342
SHA1

e50ca319857e5328bc3ba952796d097f614ea8ef
SHA256

61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31
SHA512

158c03b8f4a86bc9817d5f71d7bd6a088b6ecca488fea2c5656db9d089cd005eeaa47ce1d0569b3a2e16a00f27a93630bb8204fee2e19952cb7dc9b5d20b1ad1
SSDEEP

12288:2q1ppozb1b26o3MjKHtVtzsyRmJ0F2I1jnWlYLVFoNfO0:L1ppoVJo8atVJsyRmXIgYL/I20

Score

10^/10

qakbot aa 1648462264 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.549

Botnet

Campaign

1648462264

75.113.214.234:2222

86.98.208.214:2222

41.84.229.218:995

190.73.3.148:2222

113.11.89.170:995

45.241.152.155:993

74.15.2.252:2222

76.70.9.169:2222

103.139.242.30:993

80.11.74.81:2222

105.186.127.127:995

81.60.217.44:995

79.129.121.68:995

75.99.168.194:443

5.95.58.211:2087

129.208.19.253:995

2.34.12.8:443

108.60.213.141:443

176.67.56.94:443

176.88.238.122:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
1820	regsvr32.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1820 regsvr32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 2220 wrote to memory of 1820	2220	regsvr32.exe	regsvr32.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe
PID 1820 wrote to memory of 1976	1820	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download
memory/1820-6-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download
memory/1820-9-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download
memory/1976-7-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1976-10-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/1976-11-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/1976-12-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/1976-14-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/1976-13-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download
memory/1976-16-0x0000000000080000-0x00000000000EC000-memory.dmp

Filesize
432KB

Download