qakbot | 74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
23-04-2021 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056.dll
Size

606KB
MD5

17e5d2175e0f253d23066ba788fbf636
SHA1

9000b6d4a6bd850e25a0eaa61dd6d2915ff6eb0e
SHA256

74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056
SHA512

6d197dfbc4359b4650497347e9913a0710c823ffd9cc9839cff5d9191b3a0d62791fb28af2d82879d4323cc6152f0124d0a087a328948e3074c3acdaca7221ab

Score

10^/10

qakbot clinton04 1618322109 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.1

Botnet

clinton04

Campaign

1618322109

75.137.47.174:443

140.82.49.12:443

151.205.102.42:443

24.226.156.153:443

24.43.22.221:993

216.201.162.158:443

76.25.142.196:443

149.28.99.97:995

149.28.101.90:2222

207.246.116.237:8443

149.28.99.97:443

45.63.107.192:2222

45.32.211.207:2222

149.28.101.90:443

45.77.117.108:995

207.246.77.75:443

207.246.77.75:8443

149.28.98.196:2222

45.32.211.207:995

45.32.211.207:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe
PID 368 wrote to memory of 1652	368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056.dll,#1
2⤵
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-59-0x0000000000000000-mapping.dmp

Download
memory/1652-60-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download
memory/1652-61-0x0000000000460000-0x00000000004FC000-memory.dmp

Filesize
624KB

Download
memory/1652-62-0x0000000000240000-0x000000000027C000-memory.dmp

Filesize
240KB

Download
memory/1652-63-0x0000000000170000-0x0000000000189000-memory.dmp

Filesize
100KB

Download