qakbot | 595161418d4eae727175da894f9b6f3ec849834b79bc0162106943044fa01135

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 16:45

Target
qbot.dll
Size 764KB
Sample221005-t9darsfbep
SHA256 595161418d4eae727175da894f9b6f3ec849834b79bc0162106943044fa01135
MD5 152d7fed0cdad59736c8519f0d00a4fd
SHA1 c45277d49f1ebf373b32df86ef591c6d6f27957f
SHA512 6601f6ee70efcc809c61cd1d55173b9cb9d1f244e69ef9d3bd64db23b77d63b867c9c51407890310aeb528eabb9a2d8677f1385d8bd21841b80ac08b776112d1
SSDEEP 12288:zxnt9hlMvNICAY0KEkAOl7G79Ph0TF38ME:tt9+JFEkAmGAB38M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	448	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
448	rundll32.exe
448	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 448	4728	rundll32.exe	81
PID 4728 wrote to memory of 448	4728	rundll32.exe	81
PID 4728 wrote to memory of 448	4728	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qbot.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 668
    3⤵
    - Program crash
    PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 448 -ip 448
1⤵
PID:4112

memory/448-133-0x0000000002D60000-0x0000000002D82000-memory.dmp

Download

memory/448-134-0x0000000002CF0000-0x0000000002D31000-memory.dmp

Download

memory/448-135-0x0000000002D60000-0x0000000002D82000-memory.dmp

Download