Overview

overview

10

Static

static

40d8f98058...1f.dll

windows7_x64

10

40d8f98058...1f.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    14/04/2022, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll
  • Size 819KB
  • Sample220414-pgk3pabch9
  • SHA256 40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f
  • MD5 SHA1 SHA512
Score
10/10
qakbotaa1648110482bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.549

Botnet

  • AA

Campaign

  • 1648110482

C2

  • 90.120.65.153:2078

  • 179.100.109.11:32101

  • 24.43.99.75:443

  • 37.186.54.166:995

  • 47.23.89.62:993

  • 72.76.94.99:443

  • 117.248.109.38:21

  • 75.99.168.194:61201

  • 31.215.69.127:443

  • 45.9.20.200:443

  • 203.122.46.130:443

  • 173.174.216.62:443

  • 144.202.2.175:995

  • 149.28.238.199:443

  • 140.82.63.183:443

  • 45.63.1.12:443

  • 140.82.63.183:995

  • 144.202.3.39:995

  • 45.63.1.12:995

  • 45.76.167.26:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\40d8f98058912e2c499141a3c7f075ebe9b46fe4ea6a6bcf7e5bb9360d55dd1f.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4180

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1300-125-0x0000000010000000-0x000000001006C000-memory.dmp
        Download

        memory/4180-132-0x0000000000EB0000-0x0000000000F1C000-memory.dmp
        Download