qakbot | 937c947fd9c179bfb30ce87ad9e8ca0cc5750f1c05b619df4e2ea3e4c8469082

Analysis

max time kernel
25s
max time network
34s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VDscytujyctfjkvu2.dll
Size

1.6MB
MD5

f6a7f2d466ec7999806fd8b5792fbf75
SHA1

c3b20683a679b197ca9ac013e7c163bd3e2367e0
SHA256

937c947fd9c179bfb30ce87ad9e8ca0cc5750f1c05b619df4e2ea3e4c8469082
SHA512

ed62dbd8f14f66cf65ba4e49bafdc8adee2d305a091cd91bdf7153518199da766e8c0116a80b96dec1415f056d184d7d48a312014f8964b45667ba2e62d84382

Score

10^/10

qakbot obama152 1643038242 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2344 2728 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2344	2728	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2728	rundll32.exe
2728	rundll32.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe
2344	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

2728 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2344 WerFault.exe
Token: SeBackupPrivilege 2344 WerFault.exe
Token: SeDebugPrivilege 2344 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2344	WerFault.exe
Token: SeBackupPrivilege	2344	WerFault.exe
Token: SeDebugPrivilege	2344	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2552 wrote to memory of 2728	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2728	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2728	2552	rundll32.exe	rundll32.exe
PID 2728 wrote to memory of 3636	2728	rundll32.exe	explorer.exe
PID 2728 wrote to memory of 3636	2728	rundll32.exe	explorer.exe
PID 2728 wrote to memory of 3636	2728	rundll32.exe	explorer.exe
PID 2728 wrote to memory of 3636	2728	rundll32.exe	explorer.exe
PID 2728 wrote to memory of 3636	2728	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VDscytujyctfjkvu2.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 700
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-120-0x0000000002C90000-0x0000000002CD3000-memory.dmp

Filesize
268KB

Download
memory/2728-121-0x00000000045C0000-0x00000000045E1000-memory.dmp

Filesize
132KB

Download
memory/3636-122-0x0000000002590000-0x00000000025B1000-memory.dmp

Filesize
132KB

Download