qakbot | 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b

Analysis

max time kernel
121s
max time network
126s
platform
windows10_x64
resource
win10-en-20211104
submitted
17/11/2021, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll
Size 552KB
Sample211117-bvm8baddaj
SHA256 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
MD5 13fc44f206bcd75d2880d39a22d777a3
SHA1 5cd8cc40a71dc9a2b5ea8b023cb6f8bdb1c16748
SHA512 3e12bed7857bf1c1395127caf5714ab5eb5a28216c4cd6b0e7aba2d5a7756619d88e21de9100a27b63492ad44bcf592b32266a902e26e1403196d5abe2d7f22d
MD5 SHA1 SHA512

Score

10^/10

qakbot obama128b 1636996378 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama128b

Campaign

1636996378

93.48.80.198:995
189.135.61.226:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
50.194.160.233:443
50.194.160.233:32100
24.229.150.54:995
140.82.49.12:443
108.4.67.252:443
136.143.11.232:443
109.177.77.68:995
181.118.183.27:443
24.55.112.61:443
109.12.111.14:443
216.238.71.31:443
190.229.18.108:465
188.50.23.59:995
120.150.218.241:995
89.101.97.139:443
45.9.20.200:2211
68.186.192.69:443
111.250.0.242:443
24.139.72.117:443
96.21.251.127:2222
102.65.38.57:443
86.98.3.14:443
91.178.126.51:995
41.228.22.180:443
100.1.119.41:443
81.250.153.227:2222
190.73.3.148:2222
68.204.7.158:443
72.252.201.34:995
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
117.198.148.69:443
71.74.12.34:443
136.232.34.70:443
65.100.174.110:8443
96.37.113.36:993
197.89.109.187:443
94.60.254.81:443
103.142.10.177:443
39.49.46.75:995
117.248.109.38:21
103.116.178.85:61200
207.246.112.221:995
207.246.112.221:443
220.255.25.187:2222
86.8.177.143:443
89.137.52.44:443
105.198.236.99:995
188.27.119.243:443
173.21.10.71:2222
123.252.190.14:443
162.244.227.45:443
73.151.236.31:443
76.25.142.196:443
176.63.117.1:22
75.66.88.33:443
41.37.255.56:443
86.173.96.86:443
187.121.88.3:995
45.46.53.140:2222
75.169.58.229:32100
72.252.201.34:465
78.153.126.175:443
86.97.160.193:443
78.191.22.144:995
206.47.134.234:2222
189.152.18.180:80
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
27.223.92.142:995
63.143.92.99:995
189.147.225.12:443
75.188.35.168:443
103.150.40.76:995
189.223.33.109:443
71.13.93.154:6881
2.222.167.138:443
182.176.180.73:443
94.196.209.83:995
103.143.8.71:995
115.186.190.72:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
146.66.139.84:443
103.116.178.85:993
67.165.206.193:993
94.110.12.148:995
189.146.127.83:443
93.48.58.123:2222
92.59.35.196:2222
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.143.8.71:443
185.53.147.51:443
216.201.162.158:443
39.52.224.170:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	3720	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3720	rundll32.exe
3720	rundll32.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe
848	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	848	WerFault.exe
Token: SeBackupPrivilege	848	WerFault.exe
Token: SeDebugPrivilege	848	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3720	2624	rundll32.exe	69
PID 2624 wrote to memory of 3720	2624	rundll32.exe	69
PID 2624 wrote to memory of 3720	2624	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2021-11-15-Qakbot-DLL-from-80.71.158.152.bin.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 764
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3720-119-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/3720-120-0x0000000004560000-0x0000000004581000-memory.dmp

Download

memory/3720-121-0x0000000004560000-0x0000000004581000-memory.dmp

Download

memory/3720-122-0x0000000000C30000-0x0000000000C50000-memory.dmp

Download

memory/3720-123-0x0000000004560000-0x0000000004581000-memory.dmp

Download