qakbot | b660a1f7a7d88cb931721e680c9911a28e83dbc6120eae3cd2875fad107206f4

Resubmissions

07/05/2022, 21:15

220507-z375fsegf410

05/05/2022, 14:36

220505-ryjx3agcc67

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05/05/2022, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44686.580625.dll
Size 741KB
Sample220505-ryjx3agcc6
SHA256 b660a1f7a7d88cb931721e680c9911a28e83dbc6120eae3cd2875fad107206f4
MD5 2fbe61ac8593a80c536329b938cbae1f
SHA1 7e3f5dc527fd730f582e37a98a698c6993091e56
SHA512 af426a8a7f55fe6d799666dbd6b5488508d584c68a4cefb53bf0b20ff1e62c33665d4cf50f83d64d168f258d6fe565b4e09f51e919b37e8f763f346598b9f315
MD5 SHA1 SHA512

Score

10^/10

qakbot obama182 1651756499 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

103.107.113.120:443
80.11.74.81:2222
177.102.2.175:32101
24.178.196.158:2222
91.177.173.10:995
181.208.248.227:443
176.67.56.94:443
202.134.152.2:2222
148.0.57.85:443
179.179.162.9:993
40.134.246.185:995
37.186.54.254:995
196.203.37.215:80
120.150.218.241:995
208.107.221.224:443
113.53.151.59:443
70.46.220.114:443
69.14.172.24:443
108.60.213.141:443
24.55.67.176:443
74.14.7.71:2222
103.246.242.202:443
172.115.177.204:2222
24.152.219.253:995
197.83.230.61:443
38.70.253.226:2222
217.165.84.177:993
118.161.34.21:443
194.36.28.102:443
32.221.224.140:995
39.33.170.57:995
81.215.196.174:443
24.139.72.117:443
113.110.253.185:995
187.207.47.198:61202
203.122.46.130:443
79.129.121.68:995
140.82.49.12:443
47.23.89.62:993
86.132.13.91:2078
75.99.168.194:443
41.228.22.180:443
148.64.96.100:443
2.50.4.57:443
67.209.195.198:443
217.128.122.65:2222
5.32.41.45:443
179.158.105.44:443
46.107.48.202:443
183.82.103.213:443
103.139.243.207:990
72.76.94.99:443
76.70.9.169:2222
93.48.80.198:995
82.152.39.39:443
2.34.12.8:443
92.132.172.197:2222
75.99.168.194:61201
89.86.33.217:443
88.228.251.169:443
120.61.3.169:443
85.246.82.244:443
89.211.182.31:2222
103.87.95.133:2222
173.174.216.62:443
86.98.208.214:2222
174.69.215.101:443
89.101.97.139:443
63.143.92.99:995
37.34.253.233:443
86.195.158.178:2222
144.202.3.39:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
140.82.63.183:995
144.202.3.39:443
140.82.63.183:443
45.63.1.12:995
149.28.238.199:995
144.202.2.175:443
45.76.167.26:443
45.76.167.26:995
94.36.195.102:2222
141.237.86.114:995
118.161.34.21:995
105.99.204.185:443
90.120.65.153:2078
2.50.17.128:2222
58.105.167.36:50000
189.146.78.175:443
104.34.212.7:32103
76.25.142.196:443
173.21.10.71:2222
73.151.236.31:443
67.165.206.193:993
45.46.53.140:2222
191.99.191.28:443
180.129.20.164:995
149.135.101.20:443
31.35.28.29:443
187.208.0.99:443
201.142.133.198:443
82.41.63.217:443
201.172.23.68:2222
72.252.157.172:990
190.252.242.69:443
70.51.152.61:2222
217.118.46.41:2222
72.252.157.172:995
5.193.104.246:2222
100.1.108.246:443
187.102.135.141:2222
47.156.191.217:443
2.191.231.178:443
109.12.111.14:443
41.215.151.247:995
103.157.122.130:21
96.37.113.36:993
186.64.67.8:443
67.69.166.79:2222
121.74.167.191:995
190.36.233.41:2222
68.204.7.158:443
197.94.84.67:443
106.51.48.170:50001
72.66.116.235:995
72.12.115.78:22
103.139.243.207:993
89.137.52.44:443
191.34.199.46:443
98.50.191.202:443
96.45.66.216:61202
102.182.232.3:995
84.241.8.23:32103
172.114.160.81:995
217.164.117.87:1194
45.9.20.200:443
47.23.89.62:995
187.172.191.97:443
24.43.99.75:443
103.88.226.30:443
182.191.92.203:995
39.44.144.64:995
45.241.254.110:993
39.57.56.19:995
121.7.223.59:2222
94.140.8.55:2222
172.114.160.81:443
39.49.69.112:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	5000	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	rundll32.exe
5000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 5000	4128	rundll32.exe	81
PID 4128 wrote to memory of 5000	4128	rundll32.exe	81
PID 4128 wrote to memory of 5000	4128	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44686.580625.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44686.580625.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 668
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5000 -ip 5000
1⤵
PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5000-131-0x0000000000920000-0x00000000009DD000-memory.dmp

Download

memory/5000-132-0x0000000002610000-0x0000000002632000-memory.dmp

Download

memory/5000-133-0x0000000000E00000-0x0000000000E22000-memory.dmp

Download

memory/5000-134-0x0000000002610000-0x0000000002632000-memory.dmp

Download