qakbot | 2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a

Analysis

max time kernel
121s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
17-12-2021 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a.dll
Size

512KB
MD5

d4886eaaba8098359b70d264487b550c
SHA1

d4e44d49440c37d6b542e01827c76913697e14c2
SHA256

2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a
SHA512

5cd3f784c98cdb4f78a4e694a7bed892905058440c9b2109a6105b5d5746cd866a114e589ec909d5eb82ce9c48bc739c82a927876dec2e06ae64d52e4111b2d9

Score

10^/10

qakbot cullinan 1639742517 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

928 3320 WerFault.exe rundll32.exe

pid	pid_target	process	target process
928	3320	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3320	rundll32.exe
3320	rundll32.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe
928	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 928 WerFault.exe
Token: SeBackupPrivilege 928 WerFault.exe
Token: SeDebugPrivilege 928 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	928	WerFault.exe
Token: SeBackupPrivilege	928	WerFault.exe
Token: SeDebugPrivilege	928	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3736 wrote to memory of 3320	3736	rundll32.exe	rundll32.exe
PID 3736 wrote to memory of 3320	3736	rundll32.exe	rundll32.exe
PID 3736 wrote to memory of 3320	3736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 752
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3320-115-0x0000000000000000-mapping.dmp

Download
memory/3320-116-0x0000000000C20000-0x0000000000CA4000-memory.dmp

Filesize
528KB

Download
memory/3320-118-0x0000000000F30000-0x0000000000F51000-memory.dmp

Filesize
132KB

Download
memory/3320-117-0x0000000000F30000-0x0000000000F51000-memory.dmp

Filesize
132KB

Download
memory/3320-119-0x0000000000350000-0x00000000003FE000-memory.dmp

Filesize
696KB

Download
memory/3320-120-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Filesize
132KB

Download
memory/3320-121-0x0000000000F30000-0x0000000000F51000-memory.dmp

Filesize
132KB

Download