qakbot | 1895945a32ce6e4a4d8ce2ba3509fc397ebb4d336fd3597dce612db42dfd9408

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2022 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

132e61d524a8e30a8bd283374f08d008656b469785c1fb8095fed9e467264316.dll
Size

728KB
MD5

26d137a0efcd6290d8a9ab9899b2172d
SHA1

c346cf3f34ae59206836d4523cbf7e8ab26b5fa4
SHA256

132e61d524a8e30a8bd283374f08d008656b469785c1fb8095fed9e467264316
SHA512

6d81a290aa700696b608e202839846028646d3ecd9a46eced81b1f135c5e7c5047dbc1a9aa5f6f190bf45e46ed9c817fb5995ea94ccf09893d5eee84bc958d4c
SSDEEP

12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIEM4W+QnwldJOCP6HlD5:9ta1DjZBBAgdZM4K6dMCSHl

Score

10^/10

qakbot bb04 1666691039 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

BB04

Campaign

1666691039

181.164.194.228:443

24.116.45.121:443

190.74.248.136:443

24.206.27.39:443

27.110.134.202:995

2.88.206.121:443

71.199.168.185:443

200.233.108.153:995

198.2.51.242:993

172.117.139.142:995

70.115.104.126:443

144.202.15.58:443

190.24.45.24:995

24.9.220.167:443

58.247.115.126:995

193.3.19.137:443

45.230.169.132:995

68.62.199.70:443

43.241.159.238:443

113.162.196.232:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	4768	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	rundll32.exe
4768	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4768	4676	rundll32.exe	80
PID 4676 wrote to memory of 4768	4676	rundll32.exe	80
PID 4676 wrote to memory of 4768	4676	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\132e61d524a8e30a8bd283374f08d008656b469785c1fb8095fed9e467264316.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\132e61d524a8e30a8bd283374f08d008656b469785c1fb8095fed9e467264316.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 708
    3⤵
    - Program crash
    PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4768 -ip 4768
1⤵
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-132-0x0000000000000000-mapping.dmp

Download
memory/4768-133-0x0000000001750000-0x0000000001779000-memory.dmp

Filesize
164KB

Download
memory/4768-134-0x0000000001450000-0x0000000001479000-memory.dmp

Filesize
164KB

Download
memory/4768-135-0x0000000001750000-0x0000000001779000-memory.dmp

Filesize
164KB

Download