qakbot | 20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214

General

Target

download.dll
Size

1.7MB
MD5

c93d00511f737f095ec5d32603fa52ab
SHA1

fd4e92245cec5b14bfc59bd496971f5397460ade
SHA256

20c3a399101410c9de0fcdc46c00d88f8e18cc36163b1cf6e1377f170d752214
SHA512

af232bff616470a7940b03ec85ccfbb8e9ca6a37ff003b57b0701482fbeaf96c847c748f72ac9dfbab852be3a6738094ada3826d21b584dc585d2e338c0228b7

Score

10^/10

qakbot obama152 1643019304 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama152

Campaign

1643019304

C2

96.80.109.57:995

209.210.95.228:32100

180.233.150.134:995

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

83.110.2.97:443

78.87.44.54:995

86.108.46.251:443

74.15.2.252:2222

102.65.38.67:443

37.203.225.248:443

75.139.7.190:2083

24.53.49.240:443

80.14.196.176:2222

94.60.254.81:443

86.98.32.228:443

130.164.129.3:443

176.67.56.94:443

31.167.160.170:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

864 3168 WerFault.exe rundll32.exe

pid	pid_target	process	target process
864	3168	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
3168	rundll32.exe
3168	rundll32.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe
864	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3168 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 864 WerFault.exe
Token: SeBackupPrivilege 864 WerFault.exe
Token: SeDebugPrivilege 864 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	864	WerFault.exe
Token: SeBackupPrivilege	864	WerFault.exe
Token: SeDebugPrivilege	864	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2768 wrote to memory of 3168	2768	rundll32.exe	rundll32.exe
PID 2768 wrote to memory of 3168	2768	rundll32.exe	rundll32.exe
PID 2768 wrote to memory of 3168	2768	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 512	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 512	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 512	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 512	3168	rundll32.exe	explorer.exe
PID 3168 wrote to memory of 512	3168	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 716
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:512

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-120-0x0000000002F50000-0x0000000002F71000-memory.dmp

Filesize
132KB

Download
memory/3168-115-0x00000000041A0000-0x0000000004348000-memory.dmp

Filesize
1.7MB

Download
memory/3168-116-0x0000000004540000-0x0000000004561000-memory.dmp

Filesize
132KB

Download
memory/3168-117-0x0000000004540000-0x0000000004561000-memory.dmp

Filesize
132KB

Download
memory/3168-118-0x00000000044F0000-0x0000000004533000-memory.dmp

Filesize
268KB

Download
memory/3168-119-0x0000000004540000-0x0000000004561000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing