qakbot | baab5c1c7d6d199435c7e9c72aedcf0a747cf671768e783ad1c7070af0b73bfa

Analysis

max time kernel
50s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2022 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7533.dll
Size

663KB
MD5

c03de59890bb60e2157efdfa0ffdcf2e
SHA1

de35d25fcf8cddb0acf8bb2669fcdeee07f096a1
SHA256

baab5c1c7d6d199435c7e9c72aedcf0a747cf671768e783ad1c7070af0b73bfa
SHA512

94942577e6c6073eab834d89ef94ec709899244e1b3772c0f47b533b79c873fc771bf8b2c42c3eea2fa1df799ef86debc09c8d172fd4adadfe2e0b9fead5c108

Score

10^/10

qakbot obama201 1657815129 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama201

Campaign

1657815129

70.46.220.114:443

179.111.8.52:32101

208.107.221.224:443

176.45.218.138:995

24.158.23.166:995

24.54.48.11:443

89.101.97.139:443

24.55.67.176:443

24.139.72.117:443

120.150.218.241:995

174.69.215.101:443

38.70.253.226:2222

41.228.22.180:443

217.165.157.202:995

172.115.177.204:2222

173.21.10.71:2222

69.14.172.24:443

47.23.89.60:993

104.34.212.7:32103

66.230.104.103:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3772 1568 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1568 rundll32.exe
1568 rundll32.exe

pid	pid_target	process	target process
3772	1568	WerFault.exe	rundll32.exe

pid	process
1568	rundll32.exe
1568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3128 wrote to memory of 1568	3128	rundll32.exe	rundll32.exe
PID 3128 wrote to memory of 1568	3128	rundll32.exe	rundll32.exe
PID 3128 wrote to memory of 1568	3128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7533.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 668
3⤵
- Program crash
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1568 -ip 1568
1⤵
PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-130-0x0000000000000000-mapping.dmp

Download
memory/1568-131-0x0000000002F80000-0x0000000002FA2000-memory.dmp

Filesize
136KB

Download
memory/1568-132-0x0000000002760000-0x0000000002789000-memory.dmp

Filesize
164KB

Download
memory/1568-133-0x0000000002F80000-0x0000000002FA2000-memory.dmp

Filesize
136KB

Download