qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
111s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff.dll
Size

846KB
MD5

c139a52991b5dc2fdba8f8eafc55d440
SHA1

ba34d509f8ba7a4f415ce2c9d13191f43cb67f42
SHA256

26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff
SHA512

a987040234a34f4d7fbb404075d168c4f3ae31a3a1d52a611d44791395d25abe2370f4f3f58a895d66fe5fc2f06aac0a5b9b4879f80f38959ee88cd59194da95

Score

10^/10

qakbot obama59 1623694216 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

obama59

Campaign

1623694216

71.41.184.10:3389

47.22.148.6:443

96.253.46.210:443

188.26.180.140:443

75.118.1.141:443

90.65.234.26:2222

83.110.109.155:2222

76.25.142.196:443

45.46.53.140:2222

105.198.236.101:443

151.205.102.42:443

216.201.162.158:443

184.185.103.157:443

189.210.115.207:443

75.137.47.174:443

72.240.200.181:2222

75.67.192.125:443

24.55.112.61:443

72.252.201.69:443

24.179.77.236:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5076 3444 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5076	3444	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3792 wrote to memory of 3444	3792	rundll32.exe	rundll32.exe
PID 3792 wrote to memory of 3444	3792	rundll32.exe	rundll32.exe
PID 3792 wrote to memory of 3444	3792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26de26ea18887ba25628c2d3e8834c00ce76b8c84d8be770f31b79c83b681cff.dll,#1
2⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 668
3⤵
- Program crash
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3444 -ip 3444
1⤵
PID:3736

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3444-130-0x0000000002590000-0x00000000025CD000-memory.dmp

Filesize
244KB

Download
memory/3444-131-0x0000000002590000-0x00000000025CD000-memory.dmp

Filesize
244KB

Download
memory/3444-134-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/3444-133-0x0000000002590000-0x00000000025CD000-memory.dmp

Filesize
244KB

Download