qakbot | 263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b

Analysis

max time kernel
119s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-12-2021 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
Size

120KB
MD5

8de802e64b88d3c81e880b0fbbf8f0bd
SHA1

6749b6d049923060ee76e402c1cf5e9f25803956
SHA256

263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b
SHA512

c56343dfefa4d5661f6c7bfa4768ccc0540b095236e58720e8227c6c0cdbd08b2868410a5de721b88cdd802dae35a53023c3d2fdbec1d6ce42ea54e9f6efd0e1

Score

10^/10

qakbot cullinan 1640170781 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640170781

14.96.108.245:61202

182.191.92.203:995

136.232.34.70:443

93.48.80.198:995

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

190.39.205.165:443

79.173.195.234:443

39.49.66.100:995

103.139.242.30:22

79.167.192.206:995

45.9.20.200:2211

24.95.61.62:443

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

103.143.8.71:6881

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3888 3776 WerFault.exe explorer.exe

pid	pid_target	process	target process
3888	3776	WerFault.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
2756	regsvr32.exe
2756	regsvr32.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

2756 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3888 WerFault.exe
Token: SeBackupPrivilege 3888 WerFault.exe
Token: SeDebugPrivilege 3888 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3888	WerFault.exe
Token: SeBackupPrivilege	3888	WerFault.exe
Token: SeDebugPrivilege	3888	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2512 wrote to memory of 2756	2512	regsvr32.exe	regsvr32.exe
PID 2512 wrote to memory of 2756	2512	regsvr32.exe	regsvr32.exe
PID 2512 wrote to memory of 2756	2512	regsvr32.exe	regsvr32.exe
PID 2756 wrote to memory of 3776	2756	regsvr32.exe	explorer.exe
PID 2756 wrote to memory of 3776	2756	regsvr32.exe	explorer.exe
PID 2756 wrote to memory of 3776	2756	regsvr32.exe	explorer.exe
PID 2756 wrote to memory of 3776	2756	regsvr32.exe	explorer.exe
PID 2756 wrote to memory of 3776	2756	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmp\263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\tmp\263acfc1ee6fa4f0a65eae75dfcef1996dd4650a961dd5ec2020d37ee8ba392b.exe.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 836
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-115-0x0000000000000000-mapping.dmp

Download
memory/3776-116-0x0000000000000000-mapping.dmp

Download
memory/3776-117-0x0000000002560000-0x0000000002581000-memory.dmp

Filesize
132KB

Download