qakbot | d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0

Analysis

max time kernel
121s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
19-12-2021 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll
Size

512KB
MD5

1a0c333053b2e8ee809e48ed8ff67be3
SHA1

a547b3002ce848d130af2129843c29c9585fc0f8
SHA256

d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0
SHA512

618c0398edda1cdaa87de6a915412ddb7c260532de1ccf6ff34b0b4f95c57b7b925e894c4c8e44ed1851df7343a0bf6bbd47aa73a8248a681abb1e05c2effddd

Score

10^/10

qakbot cullinan 1639742517 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3128 2780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3128	2780	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2780	rundll32.exe
2780	rundll32.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe
3128	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3128 WerFault.exe
Token: SeBackupPrivilege 3128 WerFault.exe
Token: SeDebugPrivilege 3128 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3128	WerFault.exe
Token: SeBackupPrivilege	3128	WerFault.exe
Token: SeDebugPrivilege	3128	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2732 wrote to memory of 2780	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2780	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2780	2732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4ab52a776afb0114dc478be94c7f85ba342a3634884c7d8c71081d11d3a70b0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 724
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-115-0x0000000000000000-mapping.dmp

Download
memory/2780-116-0x0000000000C60000-0x0000000000CE4000-memory.dmp

Filesize
528KB

Download
memory/2780-117-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2780-118-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Filesize
132KB

Download
memory/2780-119-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Filesize
132KB

Download
memory/2780-121-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Filesize
132KB

Download
memory/2780-120-0x0000000000F70000-0x0000000000F91000-memory.dmp

Filesize
132KB

Download