qakbot | 69700dfbcbe60d5b9085ca551ca1fe25556b9e78db8bca5125380bf6aba6a690

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23/05/2022, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69700dfbcbe60d5b9085ca551ca1fe25556b9e78db8bca5125380bf6aba6a690.dll
Size 579KB
Sample220523-sraw9ahfdm
SHA256 69700dfbcbe60d5b9085ca551ca1fe25556b9e78db8bca5125380bf6aba6a690
MD5 cf31d71d8b218e7a862a768404060dc1
SHA1 5a671fc2451fbd87ee5638bc14ef273a26b51c36
SHA512 e9857c1af2f2ad3a0149cf3a4db6c14c302039b8973a697aa07ff282e9776b1b61baf4601bbe113437cf34c1a4e79fd3b6cb03f0938a34ba154210256c057861
MD5 SHA1 SHA512

Score

10^/10

qakbot aa 1653295661 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.689

Botnet

Campaign

1653295661

2.50.4.57:443
24.178.196.158:2222
91.177.173.10:995
187.207.131.50:61202
81.129.112.49:2078
124.40.244.118:2222
176.67.56.94:443
140.82.49.12:443
86.97.11.30:443
108.60.213.141:443
84.241.8.23:32103
202.134.152.2:2222
39.44.66.76:995
39.44.62.55:995
197.87.182.35:443
67.209.195.198:443
182.191.92.203:995
39.52.77.102:995
103.116.178.85:995
2.34.12.8:443
217.165.109.187:993
148.64.96.100:443
197.94.85.72:443
121.7.223.59:2222
37.208.155.29:6883
37.34.253.233:443
82.152.39.39:443
90.120.65.153:2078
179.145.13.69:32101
45.241.222.104:993
1.161.122.145:443
75.99.168.194:443
37.186.54.254:995
175.145.235.37:443
93.48.80.198:995
75.99.168.194:61201
80.11.74.81:2222
183.82.103.213:443
47.23.89.60:993
39.41.249.181:995
173.174.216.62:443
78.101.84.56:2222
173.21.10.71:2222
74.14.5.179:2222
103.246.242.202:443
92.132.172.197:2222
217.128.122.65:2222
72.27.86.98:443
186.90.153.162:2222
120.150.218.241:995
78.180.86.123:443
172.114.160.81:995
148.0.15.41:443
69.14.172.24:443
32.221.224.140:995
70.46.220.114:443
46.107.48.202:443
2.50.137.155:443
86.98.208.214:2222
144.202.2.175:443
144.202.3.39:443
45.76.167.26:443
140.82.63.183:995
45.63.1.12:995
45.76.167.26:995
140.82.63.183:443
144.202.2.175:995
149.28.238.199:443
45.63.1.12:443
144.202.3.39:995
149.28.238.199:995
76.25.142.196:443
210.246.4.69:995
117.248.109.38:21
180.129.108.214:995
67.165.206.193:993
45.46.53.140:2222
73.151.236.31:443
174.69.215.101:443
85.246.82.244:443
208.107.221.224:443
82.41.63.217:443
79.80.80.29:2222
217.164.117.199:1194
196.203.37.215:80
41.228.22.180:443
41.84.238.50:995
111.125.245.118:995
120.61.2.124:443
38.70.253.226:2222
106.51.48.170:50001
187.172.219.103:443
89.137.52.44:443
109.12.111.14:443
76.70.9.169:2222
179.158.105.44:443
39.49.23.236:995
72.66.116.235:995
125.168.47.127:2222
172.115.177.204:2222
190.36.232.221:2222
190.252.242.69:443
187.208.122.239:443
101.50.67.212:995
72.76.94.99:443
181.208.248.227:443
47.156.131.10:443
70.51.138.133:2222
40.134.246.185:995
100.1.108.246:443
24.139.72.117:443
189.223.134.157:443
46.176.192.130:995
72.252.157.93:990
201.172.23.68:2222
72.252.157.93:995
189.253.111.196:443
200.148.9.225:32101
72.252.157.93:993
191.250.188.54:443
187.16.64.193:2222
102.182.232.3:995
186.105.119.233:443
24.55.67.176:443
79.129.121.68:995
86.195.158.178:2222
217.164.117.199:2222
125.24.193.41:443
118.161.37.101:995
89.86.33.217:443
47.157.227.70:443
103.107.113.83:443
41.38.167.179:995
113.89.6.31:995
41.84.233.96:443
203.122.46.130:443
197.165.163.159:995
67.69.166.79:2222
81.215.196.174:443
63.143.92.99:995
187.251.132.144:22
68.204.7.158:443
177.157.156.136:443
194.36.28.62:443
5.32.41.45:443
5.193.138.70:2222
173.22.32.101:443
94.36.195.102:2222
76.23.237.163:995
96.37.113.36:993

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	3080	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3080	rundll32.exe
3080	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3080	3568	rundll32.exe	78
PID 3568 wrote to memory of 3080	3568	rundll32.exe	78
PID 3568 wrote to memory of 3080	3568	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\69700dfbcbe60d5b9085ca551ca1fe25556b9e78db8bca5125380bf6aba6a690.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\69700dfbcbe60d5b9085ca551ca1fe25556b9e78db8bca5125380bf6aba6a690.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 724
    3⤵
    - Program crash
    PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3080 -ip 3080
1⤵
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3080-131-0x0000000000AC0000-0x0000000000B54000-memory.dmp

Download

memory/3080-132-0x0000000000EC0000-0x0000000000EE2000-memory.dmp

Download

memory/3080-133-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/3080-134-0x0000000000EC0000-0x0000000000EE2000-memory.dmp

Download