qakbot | d58e4d5035a9c6b72d7d41f8718a5833a8a59950169454fd97bee1aa909742d2

Analysis

max time kernel
136s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
28/02/2022, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d58e4d5035a9c6b72d7d41f8718a5833a8a59950169454fd97bee1aa909742d2.dll
Size 871KB
Sample220228-s8r7vseeg7
SHA256 d58e4d5035a9c6b72d7d41f8718a5833a8a59950169454fd97bee1aa909742d2
MD5 68027c65c69c103b6c0d7d8b99721fbc
SHA1 3a16c3111b099aa71d9bb56eefe831007f5b0c7d
SHA512 934bb537bdc4599c816a3b96f4384e36936c2bd1545a2761bb803b04287f640c5f65c1b2bab98646f10da5128663fc6b091198f23e5c9b13f8056340154cb2f6
MD5 SHA1 SHA512

Score

10^/10

qakbot tr 1645715783 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.549

Botnet

Campaign

1645715783

31.35.28.29:443
103.87.95.131:2222
196.203.37.215:80
41.84.241.208:443
190.206.211.182:443
196.70.116.74:443
82.152.39.39:443
74.15.2.252:2222
209.210.95.228:32100
78.96.235.245:443
75.156.151.34:443
72.252.201.34:995
149.135.101.20:443
2.50.41.69:61200
217.164.121.201:2222
68.204.7.158:443
180.233.150.134:995
69.14.172.24:443
217.164.115.166:2222
100.1.108.246:443
190.73.3.148:2222
173.21.10.71:2222
88.234.22.9:995
93.48.80.198:995
76.69.155.202:2222
186.69.101.54:443
216.46.32.83:443
82.41.63.217:443
70.51.137.204:2222
185.249.85.209:443
39.44.24.109:995
144.202.2.175:443
47.180.172.159:50010
197.165.161.159:995
102.140.71.66:443
176.67.56.94:443
66.230.104.103:443
47.180.172.159:443
140.82.49.12:443
75.99.168.194:443
206.217.0.154:995
186.64.67.57:443
72.252.201.34:990
182.191.92.203:995
24.178.196.158:2222
89.101.97.139:443
173.220.98.101:443
191.99.191.28:443
190.200.231.217:61202
47.23.89.60:993
188.50.250.205:995
173.174.216.62:443
208.101.87.135:443
40.134.247.125:995
92.177.45.46:2078
114.79.148.170:443
136.143.11.232:443
41.230.62.211:993
39.49.7.117:995
102.65.38.67:443
75.99.168.194:61201
2.50.166.152:995
37.208.160.134:61202
105.184.116.32:995
111.125.245.116:995
38.70.253.226:2222
189.253.110.57:995
106.51.48.170:50001
144.202.2.175:995
217.128.122.65:2222
96.21.251.127:2222
114.24.79.246:443
217.164.121.201:1194
190.189.33.6:32101
120.150.218.241:995
67.209.195.198:443
32.221.231.1:443
103.139.242.30:990
70.45.27.254:443
89.211.185.240:2222
120.61.2.203:443
71.74.12.34:443
130.164.206.70:443
86.98.156.119:993
197.167.48.237:995
1.161.108.147:443
197.167.48.237:993
208.107.221.224:443
124.41.193.166:443
39.52.215.102:995
39.41.139.127:995
103.139.242.30:993
139.228.65.100:2222
1.161.108.147:995
197.161.60.170:995
175.137.153.178:443
180.183.103.241:2222
115.96.89.233:443
76.169.147.192:32103
128.106.123.43:443
39.52.123.106:995
89.86.33.217:443
89.137.52.44:443
45.46.53.140:2222
121.74.187.191:995
58.105.167.35:50000
58.105.167.35:2222
31.215.99.231:443
151.253.160.2:2222
86.98.10.146:995
67.165.206.193:993
189.146.51.56:443
73.151.236.31:443
108.16.33.18:443
86.198.170.170:2222
76.25.142.196:443
109.12.111.14:443
78.101.202.183:6883
105.184.230.30:995
217.128.171.34:2222
41.84.234.121:995
86.104.98.83:443
103.142.10.177:443
86.98.11.110:443
186.16.205.26:995
84.241.8.23:32103
67.69.166.79:2222
136.232.34.70:443
5.43.209.126:443
203.101.178.94:443
47.156.191.217:443
187.248.23.187:443
186.16.205.26:53
24.152.219.253:995
72.252.201.34:993
41.186.149.166:50001
197.57.107.34:995
161.142.53.137:443
189.253.245.240:443
217.165.11.155:995
156.155.113.163:2222
217.165.146.122:32101
24.121.151.206:443
88.244.98.63:443
41.234.14.148:443
63.143.92.99:995
75.188.35.168:443
81.213.206.182:443
190.189.33.6:443
41.36.82.58:3389

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1464 created 620	1464	WerFault.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	620	WerFault.exe	80

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
620	rundll32.exe
620	rundll32.exe
1976	WerFault.exe
1976	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1976	WerFault.exe
Token: SeBackupPrivilege	1976	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 620	4972	rundll32.exe	80
PID 4972 wrote to memory of 620	4972	rundll32.exe	80
PID 4972 wrote to memory of 620	4972	rundll32.exe	80
PID 1464 wrote to memory of 620	1464	WerFault.exe	80
PID 1464 wrote to memory of 620	1464	WerFault.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58e4d5035a9c6b72d7d41f8718a5833a8a59950169454fd97bee1aa909742d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58e4d5035a9c6b72d7d41f8718a5833a8a59950169454fd97bee1aa909742d2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 664
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 620 -ip 620
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-130-0x0000000002E50000-0x0000000002EBC000-memory.dmp

Download

memory/620-131-0x0000000002E50000-0x0000000002EBC000-memory.dmp

Download

memory/620-132-0x0000000002D70000-0x0000000002DDA000-memory.dmp

Download

memory/620-133-0x0000000002E50000-0x0000000002EBC000-memory.dmp

Download