Overview

overview

10

Static

static

1ec479612f...13.dll

windows7_x64

10

1ec479612f...13.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    14/04/2022, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1ec479612fbecea9813b97b75bf7d512da8bff9e592cf580f3d07ec6cbb08613.dll
  • Size 818KB
  • Sample220414-pgk3pabch7
  • SHA256 1ec479612fbecea9813b97b75bf7d512da8bff9e592cf580f3d07ec6cbb08613
  • MD5 SHA1 SHA512
Score
10/10
qakbotaa1648110482bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.549

Botnet

  • AA

Campaign

  • 1648110482

C2

  • 90.120.65.153:2078

  • 179.100.109.11:32101

  • 24.43.99.75:443

  • 37.186.54.166:995

  • 47.23.89.62:993

  • 72.76.94.99:443

  • 117.248.109.38:21

  • 75.99.168.194:61201

  • 31.215.69.127:443

  • 45.9.20.200:443

  • 203.122.46.130:443

  • 173.174.216.62:443

  • 144.202.2.175:995

  • 149.28.238.199:443

  • 140.82.63.183:443

  • 45.63.1.12:443

  • 140.82.63.183:995

  • 144.202.3.39:995

  • 45.63.1.12:995

  • 45.76.167.26:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1ec479612fbecea9813b97b75bf7d512da8bff9e592cf580f3d07ec6cbb08613.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\1ec479612fbecea9813b97b75bf7d512da8bff9e592cf580f3d07ec6cbb08613.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4960

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3128-135-0x0000000010000000-0x000000001006C000-memory.dmp
        Download

        memory/4960-142-0x00000000010A0000-0x000000000110C000-memory.dmp
        Download