qakbot | 072a26235efacf49492603576401a73aff2b9d136b4aaef9402b1cfb92926925

Analysis

max time kernel
37s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
14-04-2021 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wiroe.oer1.dll
Size

1.4MB
MD5

439e101481408971ee0bffde70419566
SHA1

e2a69bd8477669a135250ae087b36d21cd29ae8a
SHA256

072a26235efacf49492603576401a73aff2b9d136b4aaef9402b1cfb92926925
SHA512

6a284c682e65caa9c5d2e1b5685be1ccedf57da01077a46dae8cc6d9a7ee82998247ff61100eff88614a5c0f4f8730aa6edcb0196d41a3e2a110d9045ff0efa6

Score

10^/10

qakbot tr 1618398298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

Campaign

1618398298

47.196.192.184:443

216.201.162.158:443

136.232.34.70:443

71.41.184.10:3389

140.82.49.12:443

45.63.107.192:2222

45.63.107.192:443

149.28.98.196:443

45.32.211.207:443

144.202.38.185:443

45.77.115.208:2222

45.77.115.208:8443

207.246.116.237:995

45.77.117.108:443

149.28.99.97:443

149.28.99.97:995

149.28.98.196:995

45.32.211.207:995

45.32.211.207:2222

149.28.98.196:2222

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

580 1084 WerFault.exe rundll32.exe

pid	pid_target	process	target process
580	1084	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1084	rundll32.exe
1084	rundll32.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 580 WerFault.exe
Token: SeBackupPrivilege 580 WerFault.exe
Token: SeDebugPrivilege 580 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	580	WerFault.exe
Token: SeBackupPrivilege	580	WerFault.exe
Token: SeDebugPrivilege	580	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 1084	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1084	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1084	808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wiroe.oer1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wiroe.oer1.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 780
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-114-0x0000000000000000-mapping.dmp

Download
memory/1084-115-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1084-116-0x0000000004AA0000-0x0000000004AE2000-memory.dmp

Filesize
264KB

Download
memory/1084-117-0x0000000004B30000-0x0000000004B69000-memory.dmp

Filesize
228KB

Download