qakbot | 898fa15b790b45f2806672ef27c1803407ca2c66b347013b0955d9fd7ea4cd78

Analysis

max time kernel
157s
max time network
142s
platform
windows10_x64
resource
win10-en-20211014
submitted
16/11/2021, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4444444.dat.dll
Size 693KB
Sample211116-r5vyxaecd2
SHA256 898fa15b790b45f2806672ef27c1803407ca2c66b347013b0955d9fd7ea4cd78
MD5 c67783eeb3c1982e0676133160331051
SHA1 6f65d1871454414ff9aa950620031c3ca0d08298
SHA512 5246f2889404e410927f3f9202aeea6d23279cd418ae005dc7b0191b31956f931fc84f6fd0a4d2a96e91904ced26bbb8e5a51537f3b990960bab4af752beb7f6
MD5 SHA1 SHA512

Score

10^/10

qakbot obama129 1637062221 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama129

Campaign

1637062221

117.248.109.38:21
117.203.51.17:443
103.142.10.177:443
109.177.77.68:995
45.9.20.200:2211
78.191.45.163:995
102.65.38.57:443
136.143.11.232:443
91.178.126.51:995
187.121.88.3:995
181.118.183.60:443
72.252.201.34:465
111.250.51.232:443
220.255.25.187:2222
39.49.23.166:995
188.27.119.243:443
209.210.95.228:443
190.73.3.148:2222
86.8.177.143:443
136.232.34.70:443
80.6.192.58:443
140.82.49.12:443
103.116.178.85:61200
89.101.97.139:443
86.98.37.65:443
105.198.236.99:995
27.5.5.31:2222
197.89.109.235:443
216.238.71.31:443
176.45.250.182:995
41.235.5.174:443
86.97.160.193:443
81.250.153.227:2222
76.25.142.196:443
173.21.10.71:2222
120.150.218.241:995
73.151.236.31:443
71.74.12.34:443
45.46.53.140:2222
189.135.61.226:443
190.229.18.108:465
65.100.174.110:8443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
50.194.160.233:443
50.194.160.233:32100
24.229.150.54:995
108.4.67.252:443
176.63.117.1:22
94.60.254.81:443
24.55.112.61:443
109.12.111.14:443
68.186.192.69:443
96.21.251.127:2222
24.139.72.117:443
41.228.22.180:443
100.1.119.41:443
93.48.80.198:995
68.204.7.158:443
72.252.201.34:995
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
96.37.113.36:993
207.246.112.221:995
207.246.112.221:443
89.137.52.44:443
123.252.190.14:443
162.244.227.45:443
75.66.88.33:443
86.173.96.86:443
75.169.58.229:32100
78.153.126.175:443
206.47.134.234:2222
189.152.18.180:80
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
27.223.92.142:995
63.143.92.99:995
189.147.225.12:443
75.188.35.168:443
103.150.40.76:995
189.223.33.109:443
71.13.93.154:6881
2.222.167.138:443
182.176.180.73:443
94.196.209.83:995
103.143.8.71:995
103.27.22.162:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
146.66.139.84:443
103.116.178.85:993
67.165.206.193:993
178.51.47.120:995
189.146.127.83:443
93.48.58.123:2222
92.59.35.196:2222
109.133.93.127:995
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.143.8.71:443
185.53.147.51:443
216.201.162.158:443
39.52.224.170:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3964	2972	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2972	rundll32.exe
2972	rundll32.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe
3964	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2972	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3964	WerFault.exe
Token: SeBackupPrivilege	3964	WerFault.exe
Token: SeDebugPrivilege	3964	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2972	1912	rundll32.exe	68
PID 1912 wrote to memory of 2972	1912	rundll32.exe	68
PID 1912 wrote to memory of 2972	1912	rundll32.exe	68
PID 2972 wrote to memory of 3528	2972	rundll32.exe	71
PID 2972 wrote to memory of 3528	2972	rundll32.exe	71
PID 2972 wrote to memory of 3528	2972	rundll32.exe	71
PID 2972 wrote to memory of 3528	2972	rundll32.exe	71
PID 2972 wrote to memory of 3528	2972	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4444444.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4444444.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 756
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-116-0x00000000029C0000-0x0000000002A71000-memory.dmp

Download

memory/2972-117-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/2972-119-0x0000000004AB0000-0x0000000004AD1000-memory.dmp

Download

memory/2972-118-0x0000000004AB0000-0x0000000004AD1000-memory.dmp

Download

memory/2972-120-0x0000000004A60000-0x0000000004A87000-memory.dmp

Download

memory/2972-121-0x0000000004AB0000-0x0000000004AD1000-memory.dmp

Download

memory/3528-123-0x0000000000800000-0x0000000000821000-memory.dmp

Download