qakbot | 2077fa13db81c1bad0a16dc803ddb74b91dcedfe634a9c1327ac53cbf0582e78

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee5b6ba63d54fa7a7c3167e125e043f4.dll
Size

728KB
MD5

ee5b6ba63d54fa7a7c3167e125e043f4
SHA1

d540252c07398c4ce616cc3e94ac7fc0b30cf514
SHA256

d563566ddc31541ced93b85ac6e16df102935cb68e28bbe3458aa67d25106885
SHA512

23af5e42814d0372dc23ce457a4216f829eec77e3bbea331334c62e021a32c876418c8d30f19791e291a7577b53327dcf8d25b984da95798a57d67c3b7a5b3d4
SSDEEP

12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIpM4WV6nwldJOCPrHuD5:9ta1DjZBBAgdEM4F6dMCjHu

Score

10^/10

qakbot obama216 1666689942 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama216

Campaign

1666689942

24.116.45.121:443

24.206.27.39:443

71.199.168.185:443

70.115.104.126:443

190.24.45.24:995

24.9.220.167:443

68.62.199.70:443

43.241.159.238:443

113.162.196.232:443

156.217.60.239:995

197.204.70.167:443

197.202.196.43:443

24.130.228.100:443

41.109.228.108:995

64.123.103.123:443

190.193.180.228:443

24.177.111.153:443

60.54.65.27:443

189.129.38.158:2222

206.1.164.250:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	2952	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2952	rundll32.exe
2952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2952	2256	rundll32.exe	82
PID 2256 wrote to memory of 2952	2256	rundll32.exe	82
PID 2256 wrote to memory of 2952	2256	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee5b6ba63d54fa7a7c3167e125e043f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee5b6ba63d54fa7a7c3167e125e043f4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 708
    3⤵
    - Program crash
    PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2952 -ip 2952
1⤵
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-133-0x0000000000810000-0x00000000008CA000-memory.dmp

Filesize
744KB

Download
memory/2952-134-0x0000000002980000-0x00000000029A9000-memory.dmp

Filesize
164KB

Download
memory/2952-135-0x0000000002120000-0x0000000002149000-memory.dmp

Filesize
164KB

Download
memory/2952-136-0x0000000002980000-0x00000000029A9000-memory.dmp

Filesize
164KB

Download