qakbot | 454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05/05/2022, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a.dll
Size 741KB
Sample220505-vhdmwsgdc7
SHA256 454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a
MD5 e0af488d21a58e77ccc509f2a0f6e204
SHA1 d7c417ecd18f6e492301b1d0d582639841cf0792
SHA512 290aa057843de7036e562982bf0b64ab403454a9c52f55a3a32e658fe15aa76ef22c0313c803508c83075bb2f23d3b141f30375f2989983b9a400f6e784589f2
MD5 SHA1 SHA512

Score

10^/10

qakbot obama182 1651756499 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

103.107.113.120:443
80.11.74.81:2222
177.102.2.175:32101
24.178.196.158:2222
91.177.173.10:995
181.208.248.227:443
176.67.56.94:443
202.134.152.2:2222
148.0.57.85:443
179.179.162.9:993
40.134.246.185:995
37.186.54.254:995
196.203.37.215:80
120.150.218.241:995
208.107.221.224:443
113.53.151.59:443
70.46.220.114:443
69.14.172.24:443
108.60.213.141:443
24.55.67.176:443
74.14.7.71:2222
103.246.242.202:443
172.115.177.204:2222
24.152.219.253:995
197.83.230.61:443
38.70.253.226:2222
217.165.84.177:993
118.161.34.21:443
194.36.28.102:443
32.221.224.140:995
39.33.170.57:995
81.215.196.174:443
24.139.72.117:443
113.110.253.185:995
187.207.47.198:61202
203.122.46.130:443
79.129.121.68:995
140.82.49.12:443
47.23.89.62:993
86.132.13.91:2078
75.99.168.194:443
41.228.22.180:443
148.64.96.100:443
2.50.4.57:443
67.209.195.198:443
217.128.122.65:2222
5.32.41.45:443
179.158.105.44:443
46.107.48.202:443
183.82.103.213:443
103.139.243.207:990
72.76.94.99:443
76.70.9.169:2222
93.48.80.198:995
82.152.39.39:443
2.34.12.8:443
92.132.172.197:2222
75.99.168.194:61201
89.86.33.217:443
88.228.251.169:443
120.61.3.169:443
85.246.82.244:443
89.211.182.31:2222
103.87.95.133:2222
173.174.216.62:443
86.98.208.214:2222
174.69.215.101:443
89.101.97.139:443
63.143.92.99:995
37.34.253.233:443
86.195.158.178:2222
144.202.3.39:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
140.82.63.183:995
144.202.3.39:443
140.82.63.183:443
45.63.1.12:995
149.28.238.199:995
144.202.2.175:443
45.76.167.26:443
45.76.167.26:995
94.36.195.102:2222
141.237.86.114:995
118.161.34.21:995
105.99.204.185:443
90.120.65.153:2078
2.50.17.128:2222
58.105.167.36:50000
189.146.78.175:443
104.34.212.7:32103
76.25.142.196:443
173.21.10.71:2222
73.151.236.31:443
67.165.206.193:993
45.46.53.140:2222
191.99.191.28:443
180.129.20.164:995
149.135.101.20:443
31.35.28.29:443
187.208.0.99:443
201.142.133.198:443
82.41.63.217:443
201.172.23.68:2222
72.252.157.172:990
190.252.242.69:443
70.51.152.61:2222
217.118.46.41:2222
72.252.157.172:995
5.193.104.246:2222
100.1.108.246:443
187.102.135.141:2222
47.156.191.217:443
2.191.231.178:443
109.12.111.14:443
41.215.151.247:995
103.157.122.130:21
96.37.113.36:993
186.64.67.8:443
67.69.166.79:2222
121.74.167.191:995
190.36.233.41:2222
68.204.7.158:443
197.94.84.67:443
106.51.48.170:50001
72.66.116.235:995
72.12.115.78:22
103.139.243.207:993
89.137.52.44:443
191.34.199.46:443
98.50.191.202:443
96.45.66.216:61202
102.182.232.3:995
84.241.8.23:32103
172.114.160.81:995
217.164.117.87:1194
45.9.20.200:443
47.23.89.62:995
187.172.191.97:443
24.43.99.75:443
103.88.226.30:443
182.191.92.203:995
39.44.144.64:995
45.241.254.110:993
39.57.56.19:995
121.7.223.59:2222
94.140.8.55:2222
172.114.160.81:443
39.49.69.112:995

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	3476	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	rundll32.exe
3476	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3476	460	rundll32.exe	84
PID 460 wrote to memory of 3476	460	rundll32.exe	84
PID 460 wrote to memory of 3476	460	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 668
    3⤵
    - Program crash
    PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3476 -ip 3476
1⤵
PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3476-131-0x0000000002C80000-0x0000000002CA2000-memory.dmp

Download

memory/3476-132-0x0000000002C50000-0x0000000002C72000-memory.dmp

Download

memory/3476-133-0x0000000002C80000-0x0000000002CA2000-memory.dmp

Download