Overview

overview

10

Static

static

ea1d7bb8fc...62.dll

windows7-x64

10

ea1d7bb8fc...62.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2022 07:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea1d7bb8fc95a66e5d5cb01bc996e8dd4489271cd4a04d6b45a00b65b8fab562.dll

  • Size

    354KB

  • MD5

    3bf3a9ebf5f8aa1116883220d8121a54

  • SHA1

    e610a5dd56b98cd0060256fe1bcc03761b98f1c4

  • SHA256

    ea1d7bb8fc95a66e5d5cb01bc996e8dd4489271cd4a04d6b45a00b65b8fab562

  • SHA512

    c3291bfc459497f573c320a77a09d3c588034682835813ea5865714271960a8d6ba2708be679a83efa5884cb9ca2ef1255efceb60a0318bec136bc5cb6c571ee

  • SSDEEP

    6144:hNsacLpop/C9lIbtBMHkqmO+pefW5Aw6hjSy/AACs98K/f+ZuDXKK8bTcTCaUza/:ns/tMrbQHt+psBw6RcA3/2oXmbTdaUm/

Score
10/10
qakbotobama2201667373670bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

404.14

Botnet

obama220

Campaign

1667373670

C2

174.0.224.214:443

1.70.60.142:54792

74.33.84.227:443

1.175.205.2:13825

187.1.1.45:12681

190.24.45.24:995

1.50.68.204:18177

193.3.19.137:443

1.41.44.11:58115

73.165.119.20:443

58.247.115.126:995

1.84.35.26:3587

216.82.134.218:443

1.181.164.194:58369

187.1.1.74:23795

71.199.168.185:443

1.94.49.5:29697

187.0.1.108:11471

186.73.140.43:443

1.97.119.214:59649
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea1d7bb8fc95a66e5d5cb01bc996e8dd4489271cd4a04d6b45a00b65b8fab562.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\ea1d7bb8fc95a66e5d5cb01bc996e8dd4489271cd4a04d6b45a00b65b8fab562.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\wermgr.exe
        C:\Windows\SysWOW64\wermgr.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1332-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1332-64-0x00000000000C0000-0x00000000000EA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/1332-65-0x00000000000C0000-0x00000000000EA000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2024-55-0x0000000000000000-mapping.dmp
    Download
  • memory/2024-56-0x0000000075A11000-0x0000000075A13000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2024-57-0x0000000000200000-0x000000000022A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2024-58-0x0000000000200000-0x000000000022A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2024-59-0x0000000000180000-0x00000000001AC000-memory.dmp
    Filesize

    176KB

    Download
  • memory/2024-60-0x0000000000200000-0x0000000000280000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2024-63-0x0000000000200000-0x000000000022A000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2028-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp
    Filesize

    8KB

    Download