qakbot | a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a

General

Target
besta.ocx.dll
Size 809KB
Sample211201-mkfahaeeb4
SHA256 a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
MD5 ff7813f09571dfdafaf75abffdc7aab1
SHA1 200f8b4ce6d49a3a13b42c590ff176bc9811dd5c
SHA512 b70bee594554bb64f376f73f3fb88d4d086539c86b6f37897c5e6328a9c7d6d8d1778b871ff28ddaa97a6b9dc37ea30a0446cc3e58b299e9b0ee6aca92c52a30
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1638169179 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

tr

Campaign

1638169179

C2

136.232.34.70:443
117.248.109.38:21
218.101.110.3:995
140.82.49.12:443
102.65.38.57:443
136.143.11.232:443
39.33.188.131:995
76.25.142.196:443
120.150.218.241:995
189.252.156.7:32101
185.53.147.51:443
103.142.10.177:443
117.198.159.148:443
217.165.237.42:443
216.238.71.31:443
207.246.112.221:995
207.246.112.221:443
45.46.53.140:2222
173.21.10.71:2222
67.165.206.193:993
189.135.21.162:443
71.74.12.34:443
86.8.177.143:443
174.20.72.123:443
73.151.236.31:443
94.60.254.81:443
89.137.52.44:443
89.101.97.139:443
109.12.111.14:443
68.204.7.158:443
27.5.4.111:2222
129.208.177.244:995
105.198.236.99:995
65.100.174.110:8443
94.200.181.154:443
65.100.174.110:995
63.143.92.99:995
201.172.31.95:80
75.188.35.168:995
186.64.67.16:443
39.49.33.135:995
182.176.180.73:443
194.36.28.26:443
103.116.178.85:993
75.66.88.33:443
187.156.138.52:443
200.114.247.160:465
189.147.174.121:443
24.139.72.117:443
75.169.58.229:32100
5.31.189.54:995
86.120.85.147:443
93.48.80.198:995
2.222.167.138:443
197.89.6.112:443
27.57.252.156:443
103.150.40.76:995
41.228.22.180:443
81.250.153.227:2222
88.244.161.183:995
111.250.48.162:443
50.194.160.233:32100
50.194.160.233:443
24.55.112.61:443
73.140.38.124:443
108.4.67.252:443
176.63.117.1:22
100.1.119.41:443
24.229.150.54:995
111.91.87.187:443
86.97.10.14:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.157:995
103.168.241.157:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
190.73.3.148:2222
80.6.192.58:443
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
91.178.126.51:995
41.235.5.174:443
96.246.158.154:995
50.194.160.233:465
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	4324	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4324	rundll32.exe
4324	rundll32.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe
3496	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3496	WerFault.exe
Token: SeBackupPrivilege	3496	WerFault.exe
Token: SeDebugPrivilege	3496	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4324	4308	rundll32.exe	68
PID 4308 wrote to memory of 4324	4308	rundll32.exe	68
PID 4308 wrote to memory of 4324	4308	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\besta.ocx.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 752
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4324-116-0x0000000002DC0000-0x0000000002F0A000-memory.dmp

Download

memory/4324-118-0x0000000004900000-0x0000000004921000-memory.dmp

Download

memory/4324-117-0x0000000004900000-0x0000000004921000-memory.dmp

Download

memory/4324-119-0x00000000031B0000-0x00000000031DE000-memory.dmp

Download

memory/4324-120-0x0000000004900000-0x0000000004921000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads