qakbot | 5f48cc6c72b98dcf70d4fd73ec5a4494a0e9278f31f28780032940f78ebe2acb

Resubmissions

16-09-2022 14:04

220916-rdladsfhg9 3

16-09-2022 14:01

220916-rb18tsbffl 10

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2022 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

now/someWe.dll
Size

961KB
MD5

5f85b4cd792d6e3e2c11a7dba359a644
SHA1

a77eb84fe77aea8e7dc9d75167afb2f79282679e
SHA256

e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190
SHA512

1e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68
SSDEEP

12288:AkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJC:adhSlNKIybLKFBC1jNRZVdobrJLNMJx

Score

10^/10

qakbot bb 1663323048 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663323048

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

179.111.111.88:32101

102.38.97.72:995

217.165.68.125:993

193.3.19.37:443

70.49.33.200:2222

31.54.39.153:2078

99.232.140.205:2222

119.82.111.158:443

134.35.10.207:443

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

41.96.56.224:443

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3208 4684 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4684 rundll32.exe
4684 rundll32.exe

pid	pid_target	process	target process
3208	4684	WerFault.exe	rundll32.exe

pid	process
4684	rundll32.exe
4684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3780 wrote to memory of 4684	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 4684	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 4684	3780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\now\someWe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\now\someWe.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 688
    3⤵
    - Program crash
    PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4684 -ip 4684
1⤵
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-132-0x0000000000000000-mapping.dmp

Download
memory/4684-133-0x0000000004000000-0x0000000004022000-memory.dmp

Filesize
136KB

Download
memory/4684-134-0x0000000002570000-0x0000000002596000-memory.dmp

Filesize
152KB

Download
memory/4684-135-0x0000000004000000-0x0000000004022000-memory.dmp

Filesize
136KB

Download