qakbot | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Target

acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27.dll
Size

611KB
MD5

650393a4720518176d8bc503cf686cf6
SHA1

ea2a8f0aab617f00a532a68a91ee96be427ce372
SHA256

acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27
SHA512

5b889d3c5a918f8c5f971ecb3a2ff5518974250ad7ddbc536b596933fd81ba90db5cb63fc9be7d70b94257de45980ff3979d1eb9cb5ff8868d699c5bfa8f2f37

Score

10^/10

qakbot tr 1633597816 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

Campaign

1633597816

120.150.218.241:995

185.250.148.74:443

89.137.52.44:443

66.103.170.104:2222

86.8.177.143:443

216.201.162.158:443

174.54.193.186:443

103.148.120.144:443

188.50.169.158:443

124.123.42.115:2222

140.82.49.12:443

199.27.127.129:443

81.241.252.59:2078

209.142.97.161:995

209.50.20.255:443

73.230.205.91:443

200.232.214.222:995

103.142.10.177:443

2.222.167.138:443

41.228.22.180:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2288 2476 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2288	2476	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2288 WerFault.exe
Token: SeBackupPrivilege 2288 WerFault.exe
Token: SeDebugPrivilege 2288 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2288	WerFault.exe
Token: SeBackupPrivilege	2288	WerFault.exe
Token: SeDebugPrivilege	2288	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2412 wrote to memory of 2476	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2476	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2476	2412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27.dll,#1
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 752
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-118-0x0000000000000000-mapping.dmp

Download
memory/2476-119-0x0000000003E40000-0x0000000003EDC000-memory.dmp

Filesize
624KB

Download
memory/2476-120-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2476-122-0x0000000005AA0000-0x0000000005AC1000-memory.dmp

Filesize
132KB

Download
memory/2476-121-0x0000000005AA0000-0x0000000005AC1000-memory.dmp

Filesize
132KB

Download
memory/2476-124-0x0000000005AA0000-0x0000000005AC1000-memory.dmp

Filesize
132KB

Download
memory/2476-123-0x0000000004170000-0x0000000004191000-memory.dmp

Filesize
132KB

Download