qakbot | b9bdc012c71b5d2c4f05ea7e664e029c1b150c2bce35e8a6b163d06710e6fcff

General

Target

b9bdc012c71b5d2c4f05ea7e664e029c1b150c2bce35e8a6b163d06710e6fcff.dll
Size

1.7MB
MD5

2adae0bfda42cf9fff04126ba39314cd
SHA1

9796375b44909e2ec56a3df756aa46532495f2bc
SHA256

b9bdc012c71b5d2c4f05ea7e664e029c1b150c2bce35e8a6b163d06710e6fcff
SHA512

0ff7be70cef828ff33f40094b6b14e09ef7da3395a1fd2c1e31090bb0259d9a287d5d11457c7b15dc82c49d9935ec1951f9b4549d31ea500e86ce2442f887409

Score

10^/10

qakbot obama153 1643117667 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama153

Campaign

1643117667

C2

217.128.93.27:2222

94.200.181.154:995

24.95.61.62:443

39.44.254.218:995

69.14.172.24:443

31.215.68.214:443

173.25.166.81:443

70.163.1.219:443

24.178.196.158:2222

89.101.97.139:443

108.4.67.252:443

217.128.171.34:2222

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

74.15.2.252:2222

185.152.45.170:995

209.210.95.228:32100

71.74.12.34:443

180.233.150.134:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 804 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1016	804	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
804	rundll32.exe
804	rundll32.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

804 rundll32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1016 WerFault.exe
Token: SeBackupPrivilege 1016 WerFault.exe
Token: SeDebugPrivilege 1016 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1016	WerFault.exe
Token: SeBackupPrivilege	1016	WerFault.exe
Token: SeDebugPrivilege	1016	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2772 wrote to memory of 804	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 804	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 804	2772	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1368	804	rundll32.exe	explorer.exe
PID 804 wrote to memory of 1368	804	rundll32.exe	explorer.exe
PID 804 wrote to memory of 1368	804	rundll32.exe	explorer.exe
PID 804 wrote to memory of 1368	804	rundll32.exe	explorer.exe
PID 804 wrote to memory of 1368	804	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9bdc012c71b5d2c4f05ea7e664e029c1b150c2bce35e8a6b163d06710e6fcff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9bdc012c71b5d2c4f05ea7e664e029c1b150c2bce35e8a6b163d06710e6fcff.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 708
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-116-0x0000000004590000-0x00000000045B1000-memory.dmp

Filesize
132KB

Download
memory/804-115-0x0000000004590000-0x00000000045B1000-memory.dmp

Filesize
132KB

Download
memory/804-117-0x0000000004540000-0x0000000004583000-memory.dmp

Filesize
268KB

Download
memory/804-118-0x0000000004590000-0x00000000045B1000-memory.dmp

Filesize
132KB

Download
memory/1368-119-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing