qakbot | aec4da4bf0f1594c4f284d6981fe5b9579a4bd314154d7566520f7991fb50f52

Analysis

max time kernel
110s
max time network
137s
platform
windows10_x64
resource
win10-en-20211014
submitted
08-12-2021 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

J241_aec4da4bf0f1594c4f284d6981fe5b9579a4bd314154d7566520f7991fb50f52.bin.dll
Size

1.4MB
MD5

0203f302574b3da2e2342d8de458e815
SHA1

06d57c40444fa2f9eb17f599697e3c0d7c6ae8df
SHA256

aec4da4bf0f1594c4f284d6981fe5b9579a4bd314154d7566520f7991fb50f52
SHA512

a4eb455c37aa611649ef19e5f94d4c8e5dc7bb641fee4640f3011b9122e26d2ddb69db192c720f6abe3ceda9373d080562806d00a05ef79298f2ed787dbe0a9f

Score

10^/10

qakbot prof01 1618558896 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.12

Botnet

prof01

Campaign

1618558896

115.133.243.6:443

47.22.148.6:443

27.223.92.142:995

184.185.103.157:443

149.28.99.97:2222

45.63.107.192:995

136.232.34.70:443

78.63.226.32:443

45.46.53.140:2222

76.25.142.196:443

193.248.221.184:2222

81.97.154.100:443

24.226.156.153:443

173.21.10.71:2222

188.26.91.212:443

71.41.184.10:3389

45.32.211.207:443

45.77.117.108:443

149.28.98.196:443

45.63.107.192:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

420 2704 WerFault.exe rundll32.exe

pid	pid_target	process	target process
420	2704	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2704	rundll32.exe
2704	rundll32.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe
420	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 420 WerFault.exe
Token: SeBackupPrivilege 420 WerFault.exe
Token: SeDebugPrivilege 420 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	420	WerFault.exe
Token: SeBackupPrivilege	420	WerFault.exe
Token: SeDebugPrivilege	420	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1920 wrote to memory of 2704	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 2704	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 2704	1920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\J241_aec4da4bf0f1594c4f284d6981fe5b9579a4bd314154d7566520f7991fb50f52.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\J241_aec4da4bf0f1594c4f284d6981fe5b9579a4bd314154d7566520f7991fb50f52.bin.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 856
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-115-0x0000000000000000-mapping.dmp

Download
memory/2704-116-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2704-117-0x0000000006800000-0x0000000006839000-memory.dmp

Filesize
228KB

Download
memory/2704-118-0x0000000006800000-0x0000000006839000-memory.dmp

Filesize
228KB

Download
memory/2704-119-0x0000000006770000-0x00000000067B2000-memory.dmp

Filesize
264KB

Download
memory/2704-120-0x0000000006800000-0x0000000006839000-memory.dmp

Filesize
228KB

Download