qakbot | 5e9f3da1a19859c920d3f12c0bffb8ae8b1773fd7f2dd9cc5dce3d4bb50dddc8

Analysis

max time kernel
88s
max time network
90s
platform
windows10_x64
resource
win10v20210408
submitted
22-09-2021 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.test.dll
Size

971KB
MD5

da03af474e59871fa4502f54b7ba5195
SHA1

9790e1335fd5c57e3d6acfe3515484d28d6ee51a
SHA256

5e9f3da1a19859c920d3f12c0bffb8ae8b1773fd7f2dd9cc5dce3d4bb50dddc8
SHA512

27d11afe7da5bac2c10ae278faaa645987127128b4504563b68bf1fedaf3a11e3dee16405694b5cc8280530e44e4bc91e1b4bf3421af7c1d9616fee3a0e27659

Score

10^/10

qakbot tr 1632152047 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.318

Botnet

Campaign

1632152047

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

744 3928 WerFault.exe rundll32.exe

pid	pid_target	process	target process
744	3928	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3928	rundll32.exe
3928	rundll32.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe
744	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 744 WerFault.exe
Token: SeBackupPrivilege 744 WerFault.exe
Token: SeDebugPrivilege 744 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	744	WerFault.exe
Token: SeBackupPrivilege	744	WerFault.exe
Token: SeDebugPrivilege	744	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3716 wrote to memory of 3928	3716	rundll32.exe	rundll32.exe
PID 3716 wrote to memory of 3928	3716	rundll32.exe	rundll32.exe
PID 3716 wrote to memory of 3928	3716	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\test.test.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 740
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-114-0x0000000000000000-mapping.dmp

Download
memory/3928-115-0x00000000032E0000-0x000000000342A000-memory.dmp

Filesize
1.3MB

Download
memory/3928-116-0x0000000005380000-0x00000000053A1000-memory.dmp

Filesize
132KB

Download
memory/3928-117-0x00000000053B0000-0x00000000053D1000-memory.dmp

Filesize
132KB

Download