qakbot | 74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056

General

Target

17e5d2175e0f253d23066ba788fbf636.dll
Size

606KB
MD5

17e5d2175e0f253d23066ba788fbf636
SHA1

9000b6d4a6bd850e25a0eaa61dd6d2915ff6eb0e
SHA256

74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056
SHA512

6d197dfbc4359b4650497347e9913a0710c823ffd9cc9839cff5d9191b3a0d62791fb28af2d82879d4323cc6152f0124d0a087a328948e3074c3acdaca7221ab

Score

10^/10

qakbot clinton04 1618322109 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

clinton04

Campaign

1618322109

C2

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2712 created 1360 2712 WerFault.exe rundll32.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1308 1360 WerFault.exe rundll32.exe
2712 1360 WerFault.exe rundll32.exe

description	pid	process	target process
PID 2712 created 1360	2712	WerFault.exe	rundll32.exe

pid	pid_target	process	target process
1308	1360	WerFault.exe	rundll32.exe
2712	1360	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

WerFault.exeWerFault.exe

pid	process
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	1308	WerFault.exe
Token: SeBackupPrivilege	1308	WerFault.exe
Token: SeDebugPrivilege	1308	WerFault.exe
Token: SeDebugPrivilege	2712	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 796 wrote to memory of 1360	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1360	796	rundll32.exe	rundll32.exe
PID 796 wrote to memory of 1360	796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e5d2175e0f253d23066ba788fbf636.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17e5d2175e0f253d23066ba788fbf636.dll,#1
2⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 680
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 700
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-114-0x0000000000000000-mapping.dmp

Download
memory/1360-116-0x0000000003350000-0x0000000003369000-memory.dmp

Filesize
100KB

Download
memory/1360-115-0x0000000004C40000-0x0000000004C7C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads