qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
4294177s
max time network
133s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8.dll
Size

505KB
MD5

155f67ab62a615b95f7d470d2406f9e7
SHA1

1c295a92aba15aeaa17d79f20362ee8ce60f9bfa
SHA256

305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8
SHA512

9d2c9273993a27a4904fac95d2279a1718d5b93c1faaf02ceb8c31df89d57b025cc26baf8749f388a29738e6ea388909fd0ee41d7363c0e94af3802d48937d83

Score

10^/10

qakbot tr 1636356456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

Campaign

1636356456

71.13.93.154:6881

91.178.126.51:995

194.36.28.190:443

86.97.8.204:443

136.232.34.70:443

93.48.80.198:995

45.9.20.200:2211

105.198.236.99:995

71.13.93.154:2222

94.60.254.81:443

120.150.218.241:995

94.200.181.154:443

71.13.93.154:2083

181.118.183.27:443

111.250.19.18:443

207.246.112.221:443

207.246.112.221:995

190.73.3.148:2222

41.37.243.129:443

136.143.11.232:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 920	1604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\305e8e14bc1552266f47de8bde90c3aaf7f22432424a2be97414a79a7dc77df8.dll,#1
2⤵
PID:920

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000076361000-0x0000000076363000-memory.dmp

Filesize
8KB

Download
memory/920-55-0x00000000007E0000-0x0000000000861000-memory.dmp

Filesize
516KB

Download
memory/920-56-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/920-58-0x0000000000870000-0x0000000000891000-memory.dmp

Filesize
132KB

Download
memory/920-57-0x0000000000870000-0x0000000000891000-memory.dmp

Filesize
132KB

Download
memory/920-60-0x0000000000870000-0x0000000000891000-memory.dmp

Filesize
132KB

Download
memory/920-61-0x0000000000310000-0x0000000000331000-memory.dmp

Filesize
132KB

Download