qakbot | 58482a9fadc9eff1df1f7b7fcbb0c41ea458e8cd5db8ace22c7eb87a316fd687

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

judicature/hairless.dll
Size

1.6MB
MD5

57490539515131a2688d82aa9654cb60
SHA1

18f24301ece65c0991d3e060d35cee7cfa889aef
SHA256

6323aa2a52e8df5103593e4632835def5244d20b7de0e76ad0e67815891093d8
SHA512

25bf6d17e36c8279f2756a903b70e9abbaad5017ce309a52c0c7d64b2b22d7f557c00f99fd67b85f88d1e10f82cc109925fca4504c92963123e55449eb3c6bf1
SSDEEP

24576:hdOBKJGDcYOGm+FpvC04Rl3ZC499TlgxE29S3GcOk8YdSkQh:hs9dm+n60YZCZY3ZR8Ydkh

Score

10^/10

qakbot bb05 1667208557 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

BB05

Campaign

1667208557

174.77.209.5:443

187.0.1.74:23795

24.206.27.39:443

1.156.220.169:30723

156.216.39.119:995

58.186.75.42:443

1.156.197.160:30467

187.1.1.190:4844

186.18.210.16:443

1.181.56.171:771

90.165.109.4:2222

187.0.1.186:39742

87.57.13.215:443

187.0.1.207:52344

227.26.3.227:1

98.207.190.55:443

187.0.1.197:7017

188.49.56.189:443

102.156.160.115:443

187.0.1.24:17751

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4500	872	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	rundll32.exe
872	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 872	4048	rundll32.exe	81
PID 4048 wrote to memory of 872	4048	rundll32.exe	81
PID 4048 wrote to memory of 872	4048	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\hairless.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\judicature\hairless.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 720
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 872 -ip 872
1⤵
PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-133-0x00000000034C0000-0x00000000034EA000-memory.dmp

Filesize
168KB

Download
memory/872-134-0x0000000003460000-0x000000000348A000-memory.dmp

Filesize
168KB

Download
memory/872-135-0x00000000034C0000-0x00000000034EA000-memory.dmp

Filesize
168KB

Download
memory/872-136-0x00000000034C0000-0x00000000034EA000-memory.dmp

Filesize
168KB

Download