qakbot | 29711bc4148c2e45f7586f48269fd768619cda5e286b7f05a4e945a54aa76bfd

Analysis

max time kernel
151s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

standby/unfitted.dll
Size

728KB
MD5

e8106fc3c99391c506d3e24b378f00c9
SHA1

b728bad463ed60207cef4dbfa5216eca16e27aa5
SHA256

d85a353a3626d7e43fe54f656ad9f5c429f1c9412c0fab352ec699b116776557
SHA512

6fe033d3a6968496fb917102ace00bfa47c195a2c33076264becc504c07e3514067d842c497d04649837ced8e2bb2f196bb7cdb20ca0a9bbffbb25b026ddb96f
SSDEEP

12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIIM4WV6nwldJOCPrHuD5:9ta1DjZBBAgdZM4F6dMCjHu

Score

10^/10

qakbot obama216 1666689942 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama216

Campaign

1666689942

24.116.45.121:443

24.206.27.39:443

71.199.168.185:443

70.115.104.126:443

190.24.45.24:995

24.9.220.167:443

68.62.199.70:443

43.241.159.238:443

113.162.196.232:443

156.217.60.239:995

197.204.70.167:443

197.202.196.43:443

24.130.228.100:443

41.109.228.108:995

64.123.103.123:443

190.193.180.228:443

24.177.111.153:443

60.54.65.27:443

189.129.38.158:2222

206.1.164.250:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4220 4708 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4220	4708	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
4708	rundll32.exe
4708	rundll32.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe
4692	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

4708 rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4388 wrote to memory of 4708	4388	rundll32.exe	rundll32.exe
PID 4388 wrote to memory of 4708	4388	rundll32.exe	rundll32.exe
PID 4388 wrote to memory of 4708	4388	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 4692	4708	rundll32.exe	wermgr.exe
PID 4708 wrote to memory of 4692	4708	rundll32.exe	wermgr.exe
PID 4708 wrote to memory of 4692	4708	rundll32.exe	wermgr.exe
PID 4708 wrote to memory of 4692	4708	rundll32.exe	wermgr.exe
PID 4708 wrote to memory of 4692	4708	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\standby\unfitted.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\standby\unfitted.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 736
3⤵
- Program crash
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4708 -ip 4708
1⤵
PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4692-137-0x0000000000000000-mapping.dmp

Download
memory/4692-138-0x00000000008B0000-0x00000000008D9000-memory.dmp

Filesize
164KB

Download
memory/4692-140-0x00000000008B0000-0x00000000008D9000-memory.dmp

Filesize
164KB

Download
memory/4708-132-0x0000000000000000-mapping.dmp

Download
memory/4708-133-0x0000000001FF0000-0x00000000020AA000-memory.dmp

Filesize
744KB

Download
memory/4708-134-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download
memory/4708-135-0x0000000002A60000-0x0000000002A89000-memory.dmp

Filesize
164KB

Download
memory/4708-136-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download
memory/4708-139-0x0000000002AC0000-0x0000000002AE9000-memory.dmp

Filesize
164KB

Download