Overview

overview

10

Static

static

0fa38d62e1...c0.dll

windows7_x64

10

0fa38d62e1...c0.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    07/04/2022, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0fa38d62e10a8aae27e6624c29e94dc0.dll
  • Size 1.2MB
  • Sample220407-tsg8dsfefk
  • SHA256 1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
  • MD5 SHA1 SHA512
Score
10/10
qakbotaa1649273252bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.573

Botnet

  • AA

Campaign

  • 1649273252

C2

  • 47.23.89.62:993

  • 187.207.48.194:61202

  • 45.63.1.12:995

  • 140.82.63.183:995

  • 45.76.167.26:995

  • 140.82.63.183:443

  • 144.202.2.175:995

  • 144.202.3.39:443

  • 149.28.238.199:443

  • 144.202.3.39:995

  • 45.63.1.12:443

  • 149.28.238.199:995

  • 45.76.167.26:443

  • 144.202.2.175:443

  • 100.1.108.246:443

  • 32.221.224.140:995

  • 24.55.67.176:443

  • 31.35.28.29:443

  • 70.51.134.168:2222

  • 71.13.93.154:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\0fa38d62e10a8aae27e6624c29e94dc0.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3060

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3060-142-0x00000000012C0000-0x000000000134F000-memory.dmp
        Download

        memory/4844-135-0x0000000010000000-0x000000001008F000-memory.dmp
        Download