qakbot | 3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1

Resubmissions

14/01/2025, 14:37

250114-ry87yszrey10

01/12/2021, 16:04

211201-thx6vsgfe710

Analysis

max time kernel
123s
max time network
127s
platform
windows10_x64
resource
win10-en-20211104
submitted
01/12/2021, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Volet2.ocx.dll
Size 807KB
Sample211201-thx6vsgfe7
SHA256 3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
MD5 70ea022ce20cc54eca56b4ef9b49fcb4
SHA1 d58e7bcf9c7949b8ddaf9129a9504202094b48a3
SHA512 4ae829fc2976bade3f3f49144cf7d19d547c3a9936b32fcb4178cd557595d1b7dc9127c878c4502871b272dd6a75335d387accad73115c7a132c10c81143553a
MD5 SHA1 SHA512

Score

10^/10

qakbot obama139 1638350683 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama139

Campaign

1638350683

190.73.3.148:2222
39.49.13.81:995
105.198.236.99:995
136.143.11.232:443
2.222.167.138:443
197.89.11.160:443
117.248.109.38:21
174.20.72.123:443
140.82.49.12:443
78.180.170.159:995
103.142.10.177:443
120.150.218.241:995
91.178.126.51:995
81.250.153.227:2222
194.36.28.26:443
89.101.97.139:443
117.198.158.34:443
189.252.184.31:32101
38.70.253.226:2222
93.48.80.198:995
71.74.12.34:443
207.246.112.221:443
216.238.71.31:443
207.246.112.221:995
186.64.67.31:443
136.232.34.70:443
218.101.110.3:995
76.25.142.196:443
102.65.38.57:443
173.21.10.71:2222
94.60.254.81:443
45.46.53.140:2222
189.135.34.124:443
73.151.236.31:443
67.165.206.193:993
200.114.247.160:465
68.204.7.158:443
189.147.174.121:443
100.1.119.41:443
189.152.1.74:80
50.194.160.233:32100
174.206.64.101:443
50.194.160.233:443
24.229.150.54:995
109.12.111.14:443
217.17.56.163:2222
24.55.112.61:443
24.139.72.117:443
182.181.86.190:995
75.169.58.229:32100
129.208.154.145:995
217.165.237.42:443
89.137.52.44:443
73.25.109.183:2222
185.53.147.51:443
103.116.178.85:993
86.8.177.143:443
86.97.10.14:443
27.5.4.111:2222
80.6.192.58:443
101.50.103.248:995
65.100.174.110:8443
94.200.181.154:995
65.100.174.110:995
63.143.92.99:995
75.188.35.168:995
182.176.180.73:443
75.66.88.33:443
189.219.48.188:443
94.203.203.3:995
86.120.85.147:443
123.252.190.14:443
103.150.40.76:995
41.228.22.180:443
111.250.17.237:443
73.140.38.124:443
176.63.117.1:22
111.91.87.187:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.143:995
103.168.241.143:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	3980	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3980	rundll32.exe
3980	rundll32.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe
4284	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4284	WerFault.exe
Token: SeBackupPrivilege	4284	WerFault.exe
Token: SeDebugPrivilege	4284	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3980	2272	rundll32.exe	69
PID 2272 wrote to memory of 3980	2272	rundll32.exe	69
PID 2272 wrote to memory of 3980	2272	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Volet2.ocx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Volet2.ocx.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 760
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-119-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

memory/3980-121-0x0000000005220000-0x0000000005241000-memory.dmp

Download

memory/3980-120-0x0000000005220000-0x0000000005241000-memory.dmp

Download

memory/3980-123-0x0000000005220000-0x0000000005241000-memory.dmp

Download

memory/3980-122-0x00000000051D0000-0x00000000051FE000-memory.dmp

Download