qakbot | c0f7ebcd16182e2d5d5e05c310f161eb61eb0c20569827a09e65c1f93a866de0

Analysis

max time kernel
101s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71e4f7864d915a86246aa892fa2d48579f441627156bd3cf65508dce6acf9d02.dll
Size

502KB
MD5

c3a6d02b5417075185f4fe3053731095
SHA1

ed6f591b4a0c24c8314b1e62df799603ffc50e02
SHA256

71e4f7864d915a86246aa892fa2d48579f441627156bd3cf65508dce6acf9d02
SHA512

c1577c3d6de71181bef0dd324afeb5c4b36d874ee6fc32d55e4954892076123316f3e255ded5ff59a946ae20918ab756b7deb491b22152a6b9d79754a30e03f9
SSDEEP

12288:V2Nje8T1MgBj4W1A7IIQmVyEcij9IB/XrtJPrGYidZKCRw9WU:oNK8LBj4WmHQOAe9IB/btFyYiPw

Score

10^/10

qakbot notset 1632819510 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

notset

Campaign

1632819510

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

122.11.220.212:2222

120.151.47.189:443

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

76.25.142.196:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3640 984 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

984 rundll32.exe
984 rundll32.exe

pid	pid_target	process	target process
3640	984	WerFault.exe	rundll32.exe

pid	process
984	rundll32.exe
984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1128 wrote to memory of 984	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 984	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 984	1128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71e4f7864d915a86246aa892fa2d48579f441627156bd3cf65508dce6acf9d02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71e4f7864d915a86246aa892fa2d48579f441627156bd3cf65508dce6acf9d02.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 700
3⤵
- Program crash
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 984 -ip 984
1⤵
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-132-0x0000000000000000-mapping.dmp

Download
memory/984-133-0x00000000032C0000-0x00000000032E1000-memory.dmp

Filesize
132KB

Download
memory/984-134-0x00000000032C0000-0x00000000032E1000-memory.dmp

Filesize
132KB

Download
memory/984-135-0x0000000002E30000-0x0000000002E51000-memory.dmp

Filesize
132KB

Download
memory/984-136-0x00000000032C0000-0x00000000032E1000-memory.dmp

Filesize
132KB

Download