qakbot | acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27

Analysis

max time kernel
28s
max time network
31s
platform
windows10_x64
resource
win10v20210408
submitted
07-10-2021 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

natur.html.dll
Size

611KB
MD5

650393a4720518176d8bc503cf686cf6
SHA1

ea2a8f0aab617f00a532a68a91ee96be427ce372
SHA256

acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27
SHA512

5b889d3c5a918f8c5f971ecb3a2ff5518974250ad7ddbc536b596933fd81ba90db5cb63fc9be7d70b94257de45980ff3979d1eb9cb5ff8868d699c5bfa8f2f37

Score

10^/10

qakbot tr 1633597816 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597816

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1148 836 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1148	836	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
836	rundll32.exe
836	rundll32.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1148 WerFault.exe
Token: SeBackupPrivilege 1148 WerFault.exe
Token: SeDebugPrivilege 1148 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1148	WerFault.exe
Token: SeBackupPrivilege	1148	WerFault.exe
Token: SeDebugPrivilege	1148	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 664 wrote to memory of 836	664	rundll32.exe	rundll32.exe
PID 664 wrote to memory of 836	664	rundll32.exe	rundll32.exe
PID 664 wrote to memory of 836	664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\natur.html.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\natur.html.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 772
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-114-0x0000000000000000-mapping.dmp

Download
memory/836-115-0x0000000000750000-0x00000000007FE000-memory.dmp

Filesize
696KB

Download
memory/836-117-0x0000000005FB0000-0x0000000005FD1000-memory.dmp

Filesize
132KB

Download
memory/836-116-0x0000000005F80000-0x0000000005FA1000-memory.dmp

Filesize
132KB

Download