qakbot | 4fc1e0118459e693583c91ef043f35ac334d2abb299b9f90438cf5186299a651

Analysis

max time kernel
76s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2022 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

now/newFor.dll
Size

961KB
MD5

5f85b4cd792d6e3e2c11a7dba359a644
SHA1

a77eb84fe77aea8e7dc9d75167afb2f79282679e
SHA256

e716e9111e87e2f1cab16631ee561812cbf3b1c83c788ba5d293675d0959a190
SHA512

1e1d1704a82bbda2a06fd304dec2b1d477f90230eb38de2158d1c9e37ffd436ac875084d2d9aca403154519743bb4df1e3dc45f2cfd74aa6cf2c7b7100310b68
SSDEEP

12288:AkkiAYQjSOklPGSTHmI6S9+XruiCtDhBCaATfT0sBkPzXTwnm1cQ47glckpPWUJC:adhSlNKIybLKFBC1jNRZVdobrJLNMJx

Score

10^/10

qakbot bb 1663323048 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.862

Botnet

Campaign

1663323048

200.161.62.126:32101

70.51.132.197:2222

78.100.228.93:995

78.100.225.34:2222

179.111.111.88:32101

102.38.97.72:995

217.165.68.125:993

193.3.19.37:443

70.49.33.200:2222

31.54.39.153:2078

99.232.140.205:2222

119.82.111.158:443

134.35.10.207:443

45.51.148.111:993

186.154.92.181:443

66.181.164.43:443

41.96.56.224:443

88.231.221.198:995

76.169.76.44:2222

68.53.110.74:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 4964 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4964 rundll32.exe
4964 rundll32.exe

pid	pid_target	process	target process
1812	4964	WerFault.exe	rundll32.exe

pid	process
4964	rundll32.exe
4964	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1028 wrote to memory of 4964	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4964	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4964	1028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\now\newFor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\now\newFor.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 684
    3⤵
    - Program crash
    PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4964 -ip 4964
1⤵
PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000002840000-0x0000000002935000-memory.dmp

Filesize
980KB

Download
memory/4964-134-0x0000000004610000-0x0000000004632000-memory.dmp

Filesize
136KB

Download
memory/4964-135-0x00000000045E0000-0x0000000004606000-memory.dmp

Filesize
152KB

Download
memory/4964-136-0x0000000004610000-0x0000000004632000-memory.dmp

Filesize
136KB

Download