qakbot | 45f0b7dbf4fc33f560b353591c93af28472c6691f8f9f93eb01749bc0876350b

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gobbledygook.dat.dll
Size 627KB
Sample221027-lnrl9sbgem
SHA256 45f0b7dbf4fc33f560b353591c93af28472c6691f8f9f93eb01749bc0876350b
MD5 7af16fcfdb8a89e6fca437313be9e64d
SHA1 b2c75d59e18a19c31832bc6ff80e8acbc3a41e24
SHA512 86eb9e087a715d59f1025ad3629e3439310abf46e7f6bb908c879654d13bbf6a8590b7c0a6dc07411843ac7f6119843d06b1100eb3bd16430d9851f1c6d84913
SSDEEP 12288:cx8IFmbH8yS5XXUrIVcxxUnMnwldJOCP6HcD5q:x6y8bRZAWM6dMCSHc4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb04 1666776497 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

BB04

Campaign

1666776497

197.204.53.242:443
83.244.63.21:443
27.110.134.202:995
173.49.74.62:443
181.164.194.228:443
24.116.45.121:443
41.47.249.185:443
24.206.27.39:443
113.183.223.8:443
186.188.80.134:443
64.207.237.118:443
156.216.134.70:995
58.247.115.126:995
180.151.116.67:443
41.140.63.187:443
144.202.15.58:443
190.199.97.108:993
172.117.139.142:995
45.230.169.132:995
24.9.220.167:443
190.24.45.24:995
193.3.19.137:443
201.68.209.47:32101
68.62.199.70:443
167.58.254.85:443
156.197.230.148:995
175.205.2.54:443
200.233.108.153:995
105.106.60.149:443
102.159.110.79:995
2.88.206.121:443
190.193.180.228:443
216.131.22.236:995
190.37.174.11:2222
206.1.203.0:443
186.188.96.197:443
190.74.248.136:443
206.1.128.203:443
201.249.100.208:995
190.33.241.216:443
190.75.151.66:2222
198.2.51.242:993
90.165.109.4:2222
71.199.168.185:443
181.56.171.3:995
41.103.1.16:443
24.207.97.117:443
105.157.86.118:443
201.223.169.238:32100
47.14.229.4:443
70.60.142.214:2222
142.181.183.42:2222
41.62.165.152:443
41.97.205.96:443
41.97.14.60:443
151.213.183.141:995
75.84.234.68:443
186.18.210.16:443
41.96.204.196:443
64.123.103.123:443
186.48.174.77:995
152.170.17.136:443
160.176.151.70:995
78.179.135.247:443
191.33.187.192:2222
98.207.190.55:443
196.65.217.253:995
78.50.124.220:443
91.171.72.214:32100
186.154.189.162:995
101.109.44.197:995
97.92.4.205:8443
41.36.159.36:993
70.115.104.126:443
181.44.34.172:443
88.240.75.201:443
24.130.228.100:443
41.109.228.108:995
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
190.203.51.133:2222
96.46.230.10:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.108.223.181:443
41.104.155.245:443
65.140.11.170:443
184.159.76.47:443
105.98.223.169:443
197.0.225.39:443
41.101.193.38:443
105.155.151.29:995
196.207.146.151:443
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
186.18.77.99:443
41.107.78.169:443
149.126.159.224:443
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.199.156:2087
102.156.162.83:443
220.134.54.185:2222
88.132.109.147:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	4956	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	rundll32.exe
4956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4956	4904	rundll32.exe	82
PID 4904 wrote to memory of 4956	4904	rundll32.exe	82
PID 4904 wrote to memory of 4956	4904	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gobbledygook.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gobbledygook.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 712
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4956 -ip 4956
1⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-133-0x0000000002D60000-0x0000000002D89000-memory.dmp

Download

memory/4956-134-0x0000000002BE0000-0x0000000002C09000-memory.dmp

Download

memory/4956-135-0x0000000002D60000-0x0000000002D89000-memory.dmp

Download