qakbot | a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078

Analysis

max time kernel
134s
max time network
136s
platform
windows10_x64
resource
win10-en-20211208
submitted
22-12-2021 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll
Size

554KB
MD5

ac5fadde7c1c40afef7716420c4433bc
SHA1

c5eb80bfbef1dce11f2c504e17e201a3c6ca7257
SHA256

a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078
SHA512

314f5c185fb9681223562f5e5ce81d62d21e4394026677b23b316029ad01921d51933ca4d19061116b515cf4d8af970adeb22e1e8afe7011c256eda4aa4d8046

Score

10^/10

qakbot cullinan 1639742517 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1639742517

50.238.6.36:443

92.167.4.71:2222

89.137.52.44:443

105.198.236.99:995

117.248.109.38:21

106.51.48.170:50001

120.150.218.241:995

190.73.3.148:2222

182.56.53.180:443

186.64.87.213:443

103.142.10.177:443

65.100.174.110:443

96.21.251.127:2222

24.95.61.62:443

194.36.28.26:443

182.191.92.203:995

41.228.22.180:443

63.143.92.99:995

41.200.112.42:443

103.143.8.71:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 4016 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2264	4016	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
4016	rundll32.exe
4016	rundll32.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe
2264	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2264 WerFault.exe
Token: SeBackupPrivilege 2264 WerFault.exe
Token: SeDebugPrivilege 2264 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2264	WerFault.exe
Token: SeBackupPrivilege	2264	WerFault.exe
Token: SeDebugPrivilege	2264	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 408 wrote to memory of 4016	408	rundll32.exe	rundll32.exe
PID 408 wrote to memory of 4016	408	rundll32.exe	rundll32.exe
PID 408 wrote to memory of 4016	408	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a35d9352002297512d9aed546559832b98b775a47be40420a5702f3cf221d078.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 732
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4016-115-0x0000000000000000-mapping.dmp

Download
memory/4016-117-0x0000000004620000-0x0000000004641000-memory.dmp

Filesize
132KB

Download
memory/4016-116-0x0000000004620000-0x0000000004641000-memory.dmp

Filesize
132KB

Download
memory/4016-118-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/4016-120-0x00000000010F0000-0x0000000001111000-memory.dmp

Filesize
132KB

Download
memory/4016-119-0x0000000004620000-0x0000000004641000-memory.dmp

Filesize
132KB

Download