qakbot | 58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d

Analysis

max time kernel
123s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll
Size

1.6MB
MD5

0478380f70dea614e92761d343369b04
SHA1

be30885a48bc1d0898676c3b0d40d8ac4281d41d
SHA256

58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d
SHA512

9a92f9f0056e5aadedbe55bd27150fafdbb9b0fdf9e7ed52710b51b7b95b2580564b88a72f6b7f6015c2844a09f87eac5f9cc39a5885bf9768d7457ce1c6a8b6

Score

10^/10

qakbot tr 1643025307 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

Campaign

1643025307

103.143.8.71:6881

37.210.172.200:2222

136.143.11.232:443

190.73.3.148:2222

78.101.147.76:61202

82.152.39.39:443

65.100.174.110:995

65.100.174.110:443

111.125.245.116:995

117.248.109.38:21

31.215.99.178:443

103.142.10.177:443

39.49.110.129:995

86.97.246.244:1194

68.204.7.158:443

217.128.93.27:2222

144.86.28.125:443

94.59.253.222:2222

120.150.218.241:995

185.249.85.209:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3052 2548 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3052	2548	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2548	rundll32.exe
2548	rundll32.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3052 WerFault.exe
Token: SeBackupPrivilege 3052 WerFault.exe
Token: SeDebugPrivilege 3052 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3052	WerFault.exe
Token: SeBackupPrivilege	3052	WerFault.exe
Token: SeDebugPrivilege	3052	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2504 wrote to memory of 2548	2504	rundll32.exe	rundll32.exe
PID 2504 wrote to memory of 2548	2504	rundll32.exe	rundll32.exe
PID 2504 wrote to memory of 2548	2504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58be1575bf1aff15c05892b4cc9bc38d9b951f6640375f54d12ccd411a02488d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 672
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-120-0x0000000002DC0000-0x0000000002F0A000-memory.dmp

Filesize
1.3MB

Download
memory/2548-121-0x00000000048A0000-0x00000000048C1000-memory.dmp

Filesize
132KB

Download