Overview

overview

10

Static

static

44363.5701...at.dll

windows7_x64

10

44363.5701...at.dll

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16-06-2021 16:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44363.57011875.dat.dll

  • Size

    1.2MB

  • MD5

    c5c22867d434a8a8b57356c04d8dc78d

  • SHA1

    29824678f9b02c7fabfc06fda7809cd87331e433

  • SHA256

    1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c

  • SHA512

    6744fbf4aeb0cbb14c7b498bb8915b24f9df646f0ab02fc289dc59cd772f4b159860468c08ff2f912874a73d0b619521ab8ecb47e0bb2570097ed0cfb31ebb23

Score
10/10
qakbotbankerstealertrojan

Malware Config

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\44363.57011875.dat.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\44363.57011875.dat.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 660
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3736
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
          PID:1276
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 632
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 660
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3720

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1276-118-0x0000000000000000-mapping.dmp
      Download
    • memory/1276-119-0x0000000000A70000-0x0000000000A9F000-memory.dmp
      Filesize

      188KB

      Download
    • memory/2008-114-0x0000000000000000-mapping.dmp
      Download
    • memory/2008-115-0x00000000741A0000-0x00000000741CF000-memory.dmp
      Filesize

      188KB

      Download
    • memory/2008-116-0x00000000741A0000-0x00000000742DC000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/2008-117-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
      Filesize

      4KB

      Download