qakbot | 52321edc0c5a3fcb824d591c730e7783194ec5e1c0f617b40ffe760a876924eb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c9bef0496980f1304a14e3fa7737146_JaffaCakes118.dll
Size

167KB
MD5

0c9bef0496980f1304a14e3fa7737146
SHA1

4a40d0bbe792271c0911c09c5cdd577d7e38a399
SHA256

52321edc0c5a3fcb824d591c730e7783194ec5e1c0f617b40ffe760a876924eb
SHA512

a910b0db163f6cec3914096b3b5a05503a3e92cec82fe60e900157a173bdc154c7376bb229b01612b05eb084427ea3820291d66714b00fd9bec7098972aef916
SSDEEP

3072:WAOoSg75OpGZlF9HX2okHlmzCSkiNi1ai2SHs1XveZCU:WAOoDMpGZz9GuCEkavSH2eZ7

Score

10^/10

qakbot 1518695014 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

322.148

Campaign

1518695014

Credentials

Protocol: ftp
Host:
66.96.133.9
Port:
21
Username:
help
Password:
eT5TerAcnFe6~

Protocol: ftp
Host:
174.123.38.58
Port:
21
Username:
log@thebrainregistry.com
Password:
4BQ1MeeRAwNZEVu

Protocol: ftp
Host:
61.221.12.26
Port:
21
Username:
logger@ostergift.com
Password:
346HZGCMlwecz9S

Protocol: ftp
Host:
67.222.137.18
Port:
21
Username:
logger@grupocrepusculo.net
Password:
p4a8k6fE1FtA3pR

Protocol: ftp
Host:
107.6.152.61
Port:
21
Username:
logger@trussedup.com
Password:
RoP4Af0RKAAQ74V

179.62.153.88:443

50.198.141.161:2222

69.129.91.38:443

66.189.228.49:995

96.253.104.73:443

71.183.129.113:443

125.25.130.203:995

173.175.174.154:443

162.104.186.175:995

75.109.222.140:995

68.173.55.51:443

78.175.254.43:443

106.159.251.143:995

47.143.83.172:443

71.190.202.120:443

73.136.232.174:995

96.253.104.73:995

192.158.217.32:22

65.153.16.250:993

70.95.129.59:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 1648	1996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c9bef0496980f1304a14e3fa7737146_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c9bef0496980f1304a14e3fa7737146_JaffaCakes118.dll,#1
2⤵
PID:1648

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download