qakbot | fd9707ab0a82d91ed98adb8f588ba2a72478b76ebcbf8c2376c1bdd1700a7378

General

Target

2393223809381040.dll
Size

1.6MB
MD5

d07e5acd4f959b5942d8f126e9ba9615
SHA1

7ae07029376f9242b4a29c6b451e1695974516cd
SHA256

fd9707ab0a82d91ed98adb8f588ba2a72478b76ebcbf8c2376c1bdd1700a7378
SHA512

5d3c970a83a7637d146a140a495afbc92d14cff3a32aa1c84ae142fd76b19b67034d3de94ff164b8503de40d7402ea3b2afa42a885956153212d01865fadc3f8

Score

10^/10

qakbot obama152 1643038242 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama152

Campaign

1643038242

C2

67.209.195.198:443

75.156.151.34:443

89.101.97.139:443

23.229.117.237:443

45.9.20.200:443

70.45.174.173:443

140.82.49.12:443

86.98.47.119:61200

96.246.158.154:995

185.249.85.209:443

89.114.156.182:995

92.99.167.144:2078

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

37.210.172.200:2222

82.152.39.39:443

70.51.153.245:2222

103.143.8.71:6881

39.49.110.129:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 3768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
524	3768	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3768	rundll32.exe
3768	rundll32.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe
524	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3768 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 524 WerFault.exe
Token: SeBackupPrivilege 524 WerFault.exe
Token: SeDebugPrivilege 524 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	524	WerFault.exe
Token: SeBackupPrivilege	524	WerFault.exe
Token: SeDebugPrivilege	524	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2936 wrote to memory of 3768	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 3768	2936	rundll32.exe	rundll32.exe
PID 2936 wrote to memory of 3768	2936	rundll32.exe	rundll32.exe
PID 3768 wrote to memory of 1208	3768	rundll32.exe	explorer.exe
PID 3768 wrote to memory of 1208	3768	rundll32.exe	explorer.exe
PID 3768 wrote to memory of 1208	3768	rundll32.exe	explorer.exe
PID 3768 wrote to memory of 1208	3768	rundll32.exe	explorer.exe
PID 3768 wrote to memory of 1208	3768	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2393223809381040.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2393223809381040.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 688
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1208

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-119-0x00000000032F0000-0x0000000003311000-memory.dmp

Filesize
132KB

Download
memory/3768-116-0x0000000004CD0000-0x0000000004CF1000-memory.dmp

Filesize
132KB

Download
memory/3768-115-0x0000000004CD0000-0x0000000004CF1000-memory.dmp

Filesize
132KB

Download
memory/3768-117-0x00000000033B0000-0x00000000033F3000-memory.dmp

Filesize
268KB

Download
memory/3768-118-0x0000000004CD0000-0x0000000004CF1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing