qakbot | 79c5f4e94816c40a3621077bb9e03ed3ab41ccacdac57d053844336e860de80e

Analysis

max time kernel
22s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
25-03-2021 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79c5f4e94816c40a3621077bb9e03ed3ab41ccacdac57d053844336e860de80e.dll
Size

1.2MB
MD5

956859c26ae331722ddaf6ce4d9e5964
SHA1

c688aa1ce588ec65eb3b86334dd5483037107f79
SHA256

79c5f4e94816c40a3621077bb9e03ed3ab41ccacdac57d053844336e860de80e
SHA512

ea9ca187006b52c39cab3b785ce12414dfdc9414e50a5f20e3dafd977d70d4bee2e2b40902ba3e5a866c1ce9ed2592a9671fe8dc64deea9d33ca02ce2bb4b752

Score

10^/10

qakbot biden12 1615580905 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

biden12

Campaign

1615580905

24.229.150.54:995

109.12.111.14:443

173.21.10.71:2222

81.214.126.173:2222

75.118.1.141:443

98.252.118.134:443

71.74.12.34:443

186.31.77.42:443

81.97.154.100:443

71.117.132.169:443

24.139.72.117:443

67.165.206.193:993

106.51.52.111:443

47.196.192.184:443

71.197.126.250:443

24.95.61.62:443

47.22.148.6:443

195.12.154.8:443

71.163.223.159:443

197.45.110.165:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3500 1372 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3500	1372	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe
3500	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3500 WerFault.exe
Token: SeBackupPrivilege 3500 WerFault.exe
Token: SeDebugPrivilege 3500 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3500	WerFault.exe
Token: SeBackupPrivilege	3500	WerFault.exe
Token: SeDebugPrivilege	3500	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 1372	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1372	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1372	1192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c5f4e94816c40a3621077bb9e03ed3ab41ccacdac57d053844336e860de80e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c5f4e94816c40a3621077bb9e03ed3ab41ccacdac57d053844336e860de80e.dll,#1
2⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 776
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-2-0x0000000000000000-mapping.dmp

Download
memory/1372-3-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1372-5-0x0000000004AB0000-0x0000000004AE9000-memory.dmp

Filesize
228KB

Download
memory/1372-6-0x0000000004B30000-0x0000000004B6B000-memory.dmp

Filesize
236KB

Download
memory/3500-4-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download