qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
74s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85.dll
Size

1.1MB
MD5

6dbb15ec6810e0c5a79a462623e5198b
SHA1

72f69a2c9754a97bd88879ede867e001bac77a64
SHA256

69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85
SHA512

8d82472ae135fe7adebc02fff2a925e33f4a4907e971aca876104536c39285ae88844daa35e1881cfeac4c679bd199ccff0c0d683901f168276a43756d9f47f5

Score

10^/10

qakbot obama140 1638440931 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama140

Campaign

1638440931

120.150.218.241:995

93.48.80.198:995

78.180.170.159:995

189.252.173.60:32101

117.248.109.38:21

136.232.34.70:443

93.48.58.123:2222

39.49.59.131:995

188.55.203.55:995

105.198.236.99:995

207.246.112.221:995

207.246.112.221:443

216.238.71.31:443

136.143.11.232:443

186.64.67.31:443

2.222.167.138:443

218.101.110.3:995

190.73.3.148:2222

182.176.180.73:443

103.142.10.177:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2808 1048 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2808	1048	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1860 wrote to memory of 1048	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1048	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1048	1860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69ac3f3a76d2fdee0f031545587254ab8abc9f48d7d0b1cb54b6caea3d35bb85.dll,#1
2⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 680
3⤵
- Program crash
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1048 -ip 1048
1⤵
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-130-0x0000000000970000-0x0000000000A92000-memory.dmp

Filesize
1.1MB

Download
memory/1048-131-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/1048-133-0x0000000002D20000-0x0000000002D41000-memory.dmp

Filesize
132KB

Download
memory/1048-132-0x0000000002D20000-0x0000000002D41000-memory.dmp

Filesize
132KB

Download
memory/1048-135-0x0000000002D20000-0x0000000002D41000-memory.dmp

Filesize
132KB

Download
memory/1048-136-0x0000000002BE0000-0x0000000002C0E000-memory.dmp

Filesize
184KB

Download