qakbot | 0ec25b0db6bd1466458d898121de430e110ff3bcb870afac634240de027ab43a

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
competitive.dat.dll
Size 728KB
Sample221025-nlkr2scef5
SHA256 0ec25b0db6bd1466458d898121de430e110ff3bcb870afac634240de027ab43a
MD5 29e572000dd232365c4ce9566d220c9a
SHA1 e697100ecf834a599c95ec71d33c1f5e52b18b02
SHA512 b7ef29208a22c44fd3b6b9c848b78486bcd6b48b98cef65e9019cfcb3e9fb400d2c105b5e9ccf9a99ea2fba91ba7ddaf1277a1f544a8dbba12cbba2973bddc30
SSDEEP 12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIFM4W+QnwldJOCP6HlD5:9ta1DjZBBAgdIM4K6dMCSHl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb04 1666691039 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

BB04

Campaign

1666691039

181.164.194.228:443
24.116.45.121:443
190.74.248.136:443
24.206.27.39:443
27.110.134.202:995
2.88.206.121:443
71.199.168.185:443
200.233.108.153:995
198.2.51.242:993
172.117.139.142:995
70.115.104.126:443
144.202.15.58:443
190.24.45.24:995
24.9.220.167:443
58.247.115.126:995
193.3.19.137:443
45.230.169.132:995
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
201.68.209.47:32101
190.33.241.216:443
156.197.230.148:995
197.202.196.43:443
175.205.2.54:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
200.233.108.153:993
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
189.216.29.135:443
191.84.65.116:443
186.14.70.229:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	4540	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	rundll32.exe
4540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4540	4668	rundll32.exe	81
PID 4668 wrote to memory of 4540	4668	rundll32.exe	81
PID 4668 wrote to memory of 4540	4668	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\competitive.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\competitive.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 716
    3⤵
    - Program crash
    PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-133-0x0000000002050000-0x000000000210A000-memory.dmp

Download

memory/4540-134-0x0000000002B00000-0x0000000002B29000-memory.dmp

Download

memory/4540-135-0x0000000002AA0000-0x0000000002AC9000-memory.dmp

Download

memory/4540-136-0x0000000002B00000-0x0000000002B29000-memory.dmp

Download