Overview

overview

10

Static

static

d554cf5e1d...4b.dll

windows7_x64

10

d554cf5e1d...4b.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    09/07/2022, 07:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b.dll
  • Size 670KB
  • Sample220709-h1hckscfgn
  • SHA256 d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
  • MD5 SHA1 SHA512
Score
10/10
qakbotobama1991657265474bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Version

  • 403.780

Botnet

  • obama199

Campaign

  • 1657265474

C2

  • 121.7.223.45:2222

  • 67.209.195.198:443

  • 148.64.96.100:443

  • 92.132.132.81:2222

  • 217.128.122.65:2222

  • 47.180.172.159:443

  • 173.174.216.62:443

  • 70.46.220.114:443

  • 32.221.224.140:995

  • 69.14.172.24:443

  • 117.248.109.38:21

  • 94.59.15.180:2222

  • 38.70.253.226:2222

  • 217.165.157.202:995

  • 41.228.22.180:443

  • 67.165.206.193:993

  • 172.115.177.204:2222

  • 186.90.153.162:2222

  • 47.23.89.60:993

  • 120.150.218.241:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 700
        3⤵
        • Program crash
        PID:2052
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3460 -ip 3460
    1⤵
      PID:4400

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3460-131-0x0000000002C60000-0x0000000002C82000-memory.dmp
          Download

          memory/3460-132-0x0000000002C00000-0x0000000002C3F000-memory.dmp
          Download

          memory/3460-133-0x0000000002C60000-0x0000000002C82000-memory.dmp
          Download