qakbot | f249992ed77bcee678b3b2710b8ee21e9cadf938229b06030437f4418d99e1ec

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2022, 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

desynchronize/starless.dll
Size

705KB
MD5

bbfd4e29e9003a48532db1a07dc239dd
SHA1

4bb794a671c1ab3db9c3f41bee627a2068e225c4
SHA256

d83cada0f6ec3920d898ed987579e4463b29ed456d7dddda119e71b09ba332e9
SHA512

32f0fb91891114cfc0c9bcaef0c106483886ceee143f3d98a368b96e849a6ed56786c56b95e7e5c003294a08b67bee6ccb8b96ed92c10058244ad83578949d9f
SSDEEP

12288:m1hFLlWXKDqUkyQ8r12OkBlqMv20nxjxRuWRuiOCqvkajw:Kh9FD5pgOkBztxjxEdiOnvkajw

Score

10^/10

qakbot bb05 1667543522 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.20

Botnet

BB05

Campaign

1667543522

190.199.161.250:993

92.25.139.40:443

157.231.42.190:995

186.73.140.43:443

70.66.199.12:443

216.82.134.218:443

174.77.209.5:443

139.216.164.122:443

91.169.12.198:32100

139.5.239.14:443

50.37.149.215:443

74.92.243.113:995

74.92.243.113:50000

49.175.72.56:443

24.142.218.202:443

136.232.184.134:995

181.118.183.103:443

174.101.111.4:443

47.34.30.133:443

41.44.11.227:995

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	5080	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	rundll32.exe
5080	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5080	5012	rundll32.exe	82
PID 5012 wrote to memory of 5080	5012	rundll32.exe	82
PID 5012 wrote to memory of 5080	5012	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\desynchronize\starless.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\desynchronize\starless.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 704
    3⤵
    - Program crash
    PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5080 -ip 5080
1⤵
PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-133-0x00000000034D0000-0x00000000034FA000-memory.dmp

Filesize
168KB

Download
memory/5080-134-0x0000000003460000-0x0000000003495000-memory.dmp

Filesize
212KB

Download
memory/5080-135-0x00000000034D0000-0x00000000034FA000-memory.dmp

Filesize
168KB

Download