qakbot | 05abcf4f0220a026d9d591722428fb8cd87053aa9b5be0ee1a6d6cda27e926ce

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
13/05/2022, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05abcf4f0220a026d9d591722428fb8cd87053aa9b5be0ee1a6d6cda27e926ce.dll
Size 685KB
Sample220513-qech7safaq
SHA256 05abcf4f0220a026d9d591722428fb8cd87053aa9b5be0ee1a6d6cda27e926ce
MD5 634b2f0ec318b9583db4c4112e709355
SHA1 5903e4293699e7f8a28b6b2a3a66137eea03c272
SHA512 e1c0e790e956793075ef9db5d6d866e5fa994bb92cab49cb64ac611601595b258f091cd9b00208225700f015ac76ad2439edf3520318460e642f13bddf81a510
MD5 SHA1 SHA512

Score

10^/10

qakbot aa 1652433315 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.684

Botnet

Campaign

1652433315

103.139.243.207:990
217.128.122.65:2222
40.134.246.185:995
172.114.160.81:995
186.90.153.162:2222
75.99.168.194:61201
124.40.244.118:2222
86.98.208.214:2222
2.34.12.8:443
46.107.48.202:443
46.103.186.43:995
103.246.242.202:443
76.70.9.169:2222
72.76.94.99:443
102.65.16.245:443
45.63.1.12:443
45.76.167.26:443
144.202.3.39:995
140.82.63.183:443
144.202.2.175:995
144.202.2.175:443
140.82.63.183:995
45.63.1.12:995
149.28.238.199:443
45.76.167.26:995
144.202.3.39:443
149.28.238.199:995
173.22.32.101:443
39.44.178.7:995
197.89.17.146:443
81.129.112.49:2078
202.134.152.2:2222
189.26.55.114:443
1.161.66.82:995
183.82.103.213:443
172.115.177.204:2222
70.46.220.114:443
1.161.66.82:443
37.186.54.254:995
24.178.196.158:2222
91.177.173.10:995
176.67.56.94:443
146.66.139.14:443
201.42.3.27:32101
217.165.147.77:993
188.55.249.231:995
148.0.57.85:443
93.48.80.198:995
89.101.97.139:443
82.152.39.39:443
186.90.13.85:2222
108.60.213.141:443
187.207.131.50:61202
67.209.195.198:443
196.203.37.215:80
92.132.172.197:2222
47.23.89.60:993
37.210.156.191:2222
120.150.218.241:995
103.107.113.84:443
74.14.7.71:2222
182.182.228.80:995
32.221.224.140:995
70.51.137.64:2222
38.70.253.226:2222
90.120.65.153:2078
39.44.66.76:995
80.11.74.81:2222
31.215.102.193:2078
79.129.121.68:995
85.246.82.244:443
41.228.22.180:443
75.99.168.194:443
148.64.96.100:443
208.107.221.224:443
2.50.4.57:443
78.183.159.152:443
140.82.49.12:443
203.122.46.130:443
121.74.167.191:995
122.118.154.106:995
109.12.111.14:443
115.164.63.113:443
189.146.87.77:443
39.52.105.156:995
182.191.92.203:995
86.97.247.101:2222
67.165.206.193:993
174.69.215.101:443
76.25.142.196:443
173.21.10.71:2222
45.46.53.140:2222
187.172.191.97:443
190.252.242.69:443
82.41.63.217:443
187.208.122.239:443
181.208.248.227:443
73.151.236.31:443
72.252.157.172:990
72.252.157.172:995
187.251.132.144:22
201.142.133.198:443
100.1.108.246:443
201.1.202.82:32101
24.139.72.117:443
24.55.67.176:443
187.102.135.141:2222
191.99.191.28:443
201.172.23.68:2222
47.157.227.70:443
179.158.105.44:443
37.34.253.233:443
41.84.226.103:995
186.105.98.35:443
217.164.119.236:1194
41.84.248.225:443
189.253.214.159:443
86.195.158.178:2222
94.36.195.102:2222
45.241.145.155:993
86.190.159.132:443
39.49.48.82:995
89.86.33.217:443
69.14.172.24:443
106.51.48.170:50001
86.97.8.200:443
197.162.117.38:995
102.182.232.3:995
83.110.93.158:443
118.172.251.136:443
37.208.145.168:6883
120.61.3.164:443
191.251.134.129:443
173.174.216.62:443
84.241.8.23:32103
41.38.167.179:995
5.32.41.45:443
63.143.92.99:995
121.7.223.59:2222
58.105.167.36:50000
128.106.123.187:443
103.157.122.130:21
101.50.67.212:995
109.228.220.196:443
104.34.212.7:32103
181.222.130.143:993
24.152.219.253:995
111.125.245.118:995
39.53.165.129:995
197.205.106.232:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1208	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1208	rundll32.exe
1208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 1208	688	rundll32.exe	81
PID 688 wrote to memory of 1208	688	rundll32.exe	81
PID 688 wrote to memory of 1208	688	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05abcf4f0220a026d9d591722428fb8cd87053aa9b5be0ee1a6d6cda27e926ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05abcf4f0220a026d9d591722428fb8cd87053aa9b5be0ee1a6d6cda27e926ce.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 676
    3⤵
    - Program crash
    PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1208 -ip 1208
1⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-131-0x0000000003320000-0x0000000003342000-memory.dmp

Download

memory/1208-132-0x00000000032D0000-0x00000000032F2000-memory.dmp

Download

memory/1208-133-0x0000000003320000-0x0000000003342000-memory.dmp

Download