qakbot | 9e51a1d3598dfbd7ad11f96be2947550e64fe2e1c3a31ebf4b3bc79b9e85f86b

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 17:23

Target
0.bin.dll
Size 752KB
Sample221005-vx5d6afab7
SHA256 9e51a1d3598dfbd7ad11f96be2947550e64fe2e1c3a31ebf4b3bc79b9e85f86b
MD5 1e304c478485ed5629c21375f9549dc3
SHA1 00cefe60ef7d8f940e9ad40c44107e36233f07e9
SHA512 b6c4662da857965f0ec2bce19207ec28f52c25b202a7e6cff7bbccc2fffe67ee65d3c410c35be0ed73995bd055d84a2a26eaa9af8033520c338b253245bd6d66
SSDEEP 12288:zxnt9hlMvNICAY0KEkAOl7G79Ph0TF38ME:tt9+JFEkAmGAB38M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	5056	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	rundll32.exe
5056	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 5056	1448	rundll32.exe	82
PID 1448 wrote to memory of 5056	1448	rundll32.exe	82
PID 1448 wrote to memory of 5056	1448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0.bin.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 668
    3⤵
    - Program crash
    PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5056 -ip 5056
1⤵
PID:4116

memory/5056-133-0x00000000026E0000-0x0000000002702000-memory.dmp

Download

memory/5056-134-0x0000000002690000-0x00000000026D1000-memory.dmp

Download

memory/5056-135-0x00000000026E0000-0x0000000002702000-memory.dmp

Download