qakbot | 1e7b28d02a08d5c7268f623c1acd5c2e9b7bc4cb8195a9cd91afd69519789ee9

Analysis

max time kernel
132s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2022 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

democratization/wrestle.dll
Size

806KB
MD5

665a19143949121b401c8ecdc6c5f6e2
SHA1

d2ae17106355a04defc3df935ea5ec0deae59546
SHA256

e2cf414871e798f430eb9e54ae5d955b6ada4315b3af7418d209ac887028427f
SHA512

edf5f8d874a2e42d2a453fb7dea0810226ac0d0f7ce34947e9ff4b958d3c4e4be61855dcb0a1a5a7daf9a4ffb34c2a959bad04b4ee3064f9c74b93077c2ab77f
SSDEEP

12288:+XA+Tdb0guWIUjoxRxus7grz1yqpn0CgB3gLYFvknxByn5I117KcU4Mxn:5CG5b2ofd7grzZ5093QMOQ5iM

Score

10^/10

qakbot bb 1663570298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.894

Botnet

Campaign

1663570298

70.49.33.200:2222

66.181.164.43:443

109.155.5.164:993

99.232.140.205:2222

78.100.228.93:995

64.207.215.69:443

134.35.13.201:443

86.98.156.218:993

119.82.111.158:443

193.3.19.37:443

177.255.14.99:995

68.224.229.42:443

190.44.40.48:995

187.205.222.100:443

41.97.76.61:443

41.111.77.115:995

196.64.239.93:443

100.1.5.250:995

194.166.205.204:995

88.232.207.24:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4852 4988 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4988 rundll32.exe
4988 rundll32.exe

pid	pid_target	process	target process
4852	4988	WerFault.exe	rundll32.exe

pid	process
4988	rundll32.exe
4988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4988	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4988	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4988	4768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\democratization\wrestle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\democratization\wrestle.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 684
3⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4988 -ip 4988
1⤵
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-132-0x0000000000000000-mapping.dmp

Download
memory/4988-133-0x00000000048F0000-0x0000000004912000-memory.dmp

Filesize
136KB

Download
memory/4988-134-0x0000000001700000-0x0000000001742000-memory.dmp

Filesize
264KB

Download
memory/4988-135-0x00000000048F0000-0x0000000004912000-memory.dmp

Filesize
136KB

Download