qakbot | acb339909ab1431c2275c5c53b2554b2020e235cfe28ecb5352589397bc8a3f1

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/02/2022, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll
Size 628KB
Sample220223-rmlyaaadd7
SHA256 8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa
MD5 2a1f3fdc3e33d35c6ec52194fc02c084
SHA1 d6d56c94bd7e81acddfa39250a8a351d08c8cad2
SHA512 c8d8829be19ca10a8d8b21708d644d2e635dd08464132b83f0dbb83b3d70305eaf0c1c75fe7f2a96dd97291155c03692311d675abad7a46b8006edc2ef62f55b
MD5 SHA1 SHA512

Score

10^/10

qakbot cullinan 1640168876 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640168876

93.48.80.198:995
140.82.49.12:443
32.221.229.7:443
24.152.219.253:995
31.35.28.29:443
96.37.113.36:993
190.39.205.165:443
79.173.195.234:443
39.49.66.100:995
103.139.242.30:22
79.167.192.206:995
45.9.20.200:2211
24.95.61.62:443
37.210.226.125:61202
103.139.242.30:995
70.163.1.219:443
103.143.8.71:6881
76.169.147.192:32103
136.143.11.232:443
63.153.187.104:443
24.53.49.240:443
94.200.181.154:995
149.135.101.20:443
67.209.195.198:443
209.210.95.228:32100
96.80.109.57:995
80.14.196.176:2222
38.70.253.226:2222
24.222.20.254:443
102.65.38.67:443
217.128.93.27:2222
106.51.48.170:50001
218.101.110.3:995
82.152.39.39:443
24.178.196.158:2222
74.15.2.252:2222
103.142.10.177:443
217.165.123.47:61200
89.101.97.139:443
120.150.218.241:995
117.248.109.38:21
190.73.3.148:2222
105.106.30.144:443
186.64.87.213:443
96.21.251.127:2222
111.125.245.116:995
182.176.180.73:443
188.159.111.126:443
178.153.86.181:443
31.215.70.105:443
73.151.236.31:443
121.175.104.13:32100
182.56.80.29:443
41.228.22.180:443
217.164.247.241:2222
14.96.108.245:61202
182.191.92.203:995
136.232.34.70:443
103.139.242.30:990
173.21.10.71:2222
59.6.7.83:61200
121.175.104.13:443
76.25.142.196:443
71.74.12.34:443
94.60.254.81:443
201.172.31.95:80
187.162.59.232:995
65.100.174.110:8443
100.1.119.41:443
70.51.134.181:2222
79.160.207.214:443
40.134.247.125:995
70.224.68.92:443
105.198.236.99:995
173.25.166.81:443
176.205.152.44:443
108.4.67.252:443
109.12.111.14:443
24.55.112.61:443
50.237.134.22:995
189.174.46.65:995
75.188.35.168:443
187.189.86.168:443
114.79.148.170:443
176.24.150.197:443
95.5.133.68:995
86.98.52.117:443
200.54.14.34:80
72.252.201.34:995
103.139.242.30:443
103.139.242.30:465
103.139.242.30:993
78.101.89.174:2222
78.101.89.174:443
73.5.119.219:443
23.233.146.92:443
89.137.52.44:443
74.5.148.57:443
68.186.192.69:443
50.33.112.74:995
70.93.80.154:995
75.169.58.229:32100
63.143.92.99:995
217.39.100.89:443
46.9.77.245:995
173.71.147.134:995
75.110.250.187:443
185.249.85.205:443
65.100.174.110:443
82.78.212.133:443
83.110.107.123:443
59.88.168.108:443
65.128.74.102:443
67.165.206.193:993
68.204.7.158:443
78.101.82.198:995
80.6.192.58:443
41.97.234.150:995
114.79.145.28:443
188.54.96.91:443
50.238.6.36:443
217.165.11.65:61200
103.143.8.71:995
2.178.67.97:61202
86.198.237.51:2222
88.253.171.236:995
187.172.146.123:443
92.167.4.71:2222
189.30.244.252:995
194.36.28.26:443
84.199.230.66:443
14.96.67.177:443
182.56.57.23:995
87.70.118.51:443
93.48.58.123:2222
69.46.15.180:443
23.82.128.108:443
5.36.7.212:443
200.75.131.234:443
82.77.137.101:995
187.201.90.81:443
201.172.31.95:443
216.238.72.121:443
216.238.71.31:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4844 created 3924	4844	WerFault.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	3924	WerFault.exe	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	rundll32.exe
3924	rundll32.exe
4856	WerFault.exe
4856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4856	WerFault.exe
Token: SeBackupPrivilege	4856	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3924	5024	rundll32.exe	81
PID 5024 wrote to memory of 3924	5024	rundll32.exe	81
PID 5024 wrote to memory of 3924	5024	rundll32.exe	81
PID 4844 wrote to memory of 3924	4844	WerFault.exe	81
PID 4844 wrote to memory of 3924	4844	WerFault.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a335b358df09c862e37cc21e8c2ad7bbe7c83db762b77a8efe05bc3f31a82fa.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 628
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3924 -ip 3924
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-130-0x0000000002C30000-0x0000000002CD0000-memory.dmp

Download

memory/3924-131-0x0000000002E20000-0x0000000002E41000-memory.dmp

Download

memory/3924-132-0x0000000002E20000-0x0000000002E41000-memory.dmp

Download

memory/3924-134-0x0000000002E20000-0x0000000002E41000-memory.dmp

Download

memory/3924-133-0x0000000002DD0000-0x0000000002E13000-memory.dmp

Download