qakbot | 74857f33982d5e23d75ef1b12059f80e45e55c94a60304c0057979cd09463157

Analysis

max time kernel
120s
max time network
127s
platform
windows10_x64
resource
win10-en-20211208
submitted
20-12-2021 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74857f33982d5e23d75ef1b12059f80e45e55c94a60304c0057979cd09463157.dll
Size

512KB
MD5

1f5c1b7d2da1a526ff55b018b1e6bafc
SHA1

c4bbfa0c2b65a9c701fe1cae8e4fa67b8e06a513
SHA256

74857f33982d5e23d75ef1b12059f80e45e55c94a60304c0057979cd09463157
SHA512

8f0de45c6779aa6c4eca4af76a6950aeb7aa00e15176452086d2397e2b7d27f9d2361dcbce97866082b610fc9f017ea522c6aa7c2127292f8d3427983901b815

Score

10^/10

qakbot cullinan 1639742517 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

724 3676 WerFault.exe rundll32.exe

pid	pid_target	process	target process
724	3676	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3676	rundll32.exe
3676	rundll32.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe
724	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 724 WerFault.exe
Token: SeBackupPrivilege 724 WerFault.exe
Token: SeDebugPrivilege 724 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	724	WerFault.exe
Token: SeBackupPrivilege	724	WerFault.exe
Token: SeDebugPrivilege	724	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3344 wrote to memory of 3676	3344	rundll32.exe	rundll32.exe
PID 3344 wrote to memory of 3676	3344	rundll32.exe	rundll32.exe
PID 3344 wrote to memory of 3676	3344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74857f33982d5e23d75ef1b12059f80e45e55c94a60304c0057979cd09463157.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74857f33982d5e23d75ef1b12059f80e45e55c94a60304c0057979cd09463157.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 708
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-115-0x0000000000000000-mapping.dmp

Download
memory/3676-116-0x0000000004750000-0x0000000004771000-memory.dmp

Filesize
132KB

Download
memory/3676-117-0x0000000004750000-0x0000000004771000-memory.dmp

Filesize
132KB

Download
memory/3676-119-0x0000000004700000-0x0000000004721000-memory.dmp

Filesize
132KB

Download
memory/3676-118-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/3676-120-0x0000000004750000-0x0000000004771000-memory.dmp

Filesize
132KB

Download