qakbot | bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6

Analysis

max time kernel
161s
max time network
167s
platform
windows10_x64
resource
win10-en-20211208
submitted
23-12-2021 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll
Size

789KB
MD5

8eac118c3dd906020ee95e00d639eb75
SHA1

916ffa060883cb6f72d9e4b04b562c077d818891
SHA256

bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6
SHA512

8744c055019f726879a78f82d11cabf55b83a4b2b528781244d0c57122b4d3a8c2b53bbf49b41b4cd6cf53933785c971cc5c812ada2a3e314d7dd7e606c2bc35

Score

10^/10

qakbot obama149 1640166821 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama149

Campaign

1640166821

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

76.169.147.192:32103

136.143.11.232:443

63.153.187.104:443

24.53.49.240:443

94.200.181.154:995

149.135.101.20:443

67.209.195.198:443

209.210.95.228:32100

96.80.109.57:995

80.14.196.176:2222

38.70.253.226:2222

24.222.20.254:443

102.65.38.67:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3220 3140 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3220	3140	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3140	rundll32.exe
3140	rundll32.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe
3220	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3220 WerFault.exe
Token: SeBackupPrivilege 3220 WerFault.exe
Token: SeDebugPrivilege 3220 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3220	WerFault.exe
Token: SeBackupPrivilege	3220	WerFault.exe
Token: SeDebugPrivilege	3220	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2688 wrote to memory of 3140	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 3140	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 3140	2688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd72d58565c17bf5baac6202745afc14c8b40f58af27add05256cf5e041d6ac6.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 768
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3140-118-0x0000000000000000-mapping.dmp

Download
memory/3140-119-0x0000000004710000-0x0000000004761000-memory.dmp

Filesize
324KB

Download
memory/3140-120-0x00000000047A0000-0x00000000047C1000-memory.dmp

Filesize
132KB

Download
memory/3140-121-0x00000000047A0000-0x00000000047C1000-memory.dmp

Filesize
132KB

Download
memory/3140-122-0x00000000047A0000-0x00000000047C1000-memory.dmp

Filesize
132KB

Download