qakbot | 77689dd8ac7abb2a72720d542047f60f1fbc7a32d66c0bbd3a68220b4dad9b4d

Analysis

max time kernel
144s
max time network
148s
platform
windows10_x64
resource
win10-20220414-en
submitted
12-07-2022 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TXRTN_0620236/102755.dll
Size

686KB
MD5

20b511612dcddebce1068aac505ce9c4
SHA1

dad3a4d17d36b30cb810f103fe118b180d52a5c6
SHA256

c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c
SHA512

33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

Score

10^/10

qakbot obama200 1657548298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1752 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1752 rundll32.exe
1752 rundll32.exe

pid	pid_target	process	target process
1712	1752	WerFault.exe	rundll32.exe

pid	process
1752	rundll32.exe
1752	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1636 wrote to memory of 1752	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1752	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1752	1636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 712
    3⤵
    - Program crash
    PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-119-0x0000000000000000-mapping.dmp

Download
memory/1752-120-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-121-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-122-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-123-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-124-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-125-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-126-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-127-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-128-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-129-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-130-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-131-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-132-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-133-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-134-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-135-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-136-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-138-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-137-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-140-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-139-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-141-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-142-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-144-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-143-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-146-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-147-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-148-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-145-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-150-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-149-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-151-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-152-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-153-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-155-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-154-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-156-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-157-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-158-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-159-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-160-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-161-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-163-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-164-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-165-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-162-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-166-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-167-0x00000000030E0000-0x0000000003102000-memory.dmp

Filesize
136KB

Download
memory/1752-168-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-169-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-170-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-173-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-174-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-175-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-172-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-171-0x0000000077E60000-0x0000000077FEE000-memory.dmp

Filesize
1.6MB

Download
memory/1752-176-0x0000000003080000-0x00000000030BF000-memory.dmp

Filesize
252KB

Download
memory/1752-177-0x00000000030E0000-0x0000000003102000-memory.dmp

Filesize
136KB

Download