qakbot | 8e8fe39310a5d633d7d7b476495e527ba217684b42ab45a45be7324270e37a92

Analysis

max time kernel
90s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2022 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

standby/neurotic.dll
Size

728KB
MD5

e0b4bbea72ca368a252c40bc9bfdb30d
SHA1

79769620b9ea146e6d0030ba50f4024e2e5d5d17
SHA256

dbd97989ba69c72ea50cb643f488e73a440eabcd6ceec85d5990892f3c19ffc9
SHA512

3fce0906b92657be74456bb6f7bba2ddd0a6a19436da54b6beb1c46dc68bdfdfa363502823554b0c8fe959f6a6995e5c2691f2f08c8680eb3e3ffc84e36706e5
SSDEEP

12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIoM4WV6nwldJOCPrHuD5:9ta1DjZBBAgdZM4F6dMCjHu

Score

10^/10

qakbot obama216 1666689942 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama216

Campaign

1666689942

24.116.45.121:443

24.206.27.39:443

71.199.168.185:443

70.115.104.126:443

190.24.45.24:995

24.9.220.167:443

68.62.199.70:443

43.241.159.238:443

113.162.196.232:443

156.217.60.239:995

197.204.70.167:443

197.202.196.43:443

24.130.228.100:443

41.109.228.108:995

64.123.103.123:443

190.193.180.228:443

24.177.111.153:443

60.54.65.27:443

189.129.38.158:2222

206.1.164.250:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4204 4960 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4960 rundll32.exe
4960 rundll32.exe

pid	pid_target	process	target process
4204	4960	WerFault.exe	rundll32.exe

pid	process
4960	rundll32.exe
4960	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2624 wrote to memory of 4960	2624	rundll32.exe	rundll32.exe
PID 2624 wrote to memory of 4960	2624	rundll32.exe	rundll32.exe
PID 2624 wrote to memory of 4960	2624	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\standby\neurotic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\standby\neurotic.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 728
3⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4960 -ip 4960
1⤵
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4960-132-0x0000000000000000-mapping.dmp

Download
memory/4960-133-0x0000000001EE0000-0x0000000001F9A000-memory.dmp

Filesize
744KB

Download
memory/4960-134-0x0000000002530000-0x0000000002559000-memory.dmp

Filesize
164KB

Download
memory/4960-135-0x00000000024D0000-0x00000000024F9000-memory.dmp

Filesize
164KB

Download
memory/4960-136-0x0000000002530000-0x0000000002559000-memory.dmp

Filesize
164KB

Download
memory/4960-137-0x0000000002530000-0x0000000002559000-memory.dmp

Filesize
164KB

Download