qakbot | 863c95381f044af0f3c8a012cb8de00f0ef51e078602a880e1945e76fc869c4a

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94.dll
Size

1.1MB
MD5

1f72e3c976920f5499ad014026c73683
SHA1

6f192ab755b681ea81696653507ae78de03af66f
SHA256

47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94
SHA512

c321a3243ca716cf8fb17cddb9623246482f8f05c5c3c382898e2d441453088d7416e2dc183ded0bc9761d33eed4ad502fde70b7fa226ec2d60dca8818885db6

Score

10^/10

qakbot obama140 1638440931 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.2

Botnet

obama140

Campaign

1638440931

120.150.218.241:995

93.48.80.198:995

78.180.170.159:995

189.252.173.60:32101

117.248.109.38:21

136.232.34.70:443

93.48.58.123:2222

39.49.59.131:995

188.55.203.55:995

105.198.236.99:995

207.246.112.221:995

207.246.112.221:443

216.238.71.31:443

136.143.11.232:443

186.64.67.31:443

2.222.167.138:443

218.101.110.3:995

190.73.3.148:2222

182.176.180.73:443

103.142.10.177:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4720 3160 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4720	3160	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3372 wrote to memory of 3160	3372	rundll32.exe	rundll32.exe
PID 3372 wrote to memory of 3160	3372	rundll32.exe	rundll32.exe
PID 3372 wrote to memory of 3160	3372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea7ae3c9a8f8bb1b5525fb962f092d08a981d4cfdb41ce0d1d81ebfa35cc94.dll,#1
2⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 680
3⤵
- Program crash
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3160 -ip 3160
1⤵
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3160-131-0x0000000002B50000-0x0000000002B71000-memory.dmp

Filesize
132KB

Download
memory/3160-130-0x0000000002B50000-0x0000000002B71000-memory.dmp

Filesize
132KB

Download
memory/3160-133-0x0000000002B50000-0x0000000002B71000-memory.dmp

Filesize
132KB

Download
memory/3160-134-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/3160-135-0x0000000001120000-0x000000000114E000-memory.dmp

Filesize
184KB

Download