qakbot | 99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993

Analysis

max time kernel
62s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2_qakbot.dll
Size

230KB
MD5

6d5348e093b99e3c50b32a2af135cca6
SHA1

f87edb62046f84f8efb9f54b738850fc538c8f4c
SHA256

99ca4d78c14cfd9f6fe13b48182edf366400ea74aa712edeb780b90acf15d993
SHA512

5b9198e6f6780cb67167da8d013f353f38e596664b58d239e155178b37355aea68b0c1416c15d50184c2216a72521c360545de61c71e6631b983f2478a00d183
SSDEEP

6144:fHaya8NiG4uCak/IFz2TBkjXaqJDf2tIKw:/ra8oOCCt2TOjXaSDQIz

Score

10^/10

qakbot clinton16 1620911967 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

402.68

Botnet

clinton16

Campaign

1620911967

71.41.184.10:3389

216.201.162.158:443

95.77.223.148:443

71.74.12.34:443

86.220.62.251:2222

24.229.150.54:995

24.55.112.61:443

76.25.142.196:443

136.232.34.70:443

149.28.99.97:443

45.63.107.192:2222

45.63.107.192:443

149.28.99.97:2222

149.28.99.97:995

45.63.107.192:995

86.248.16.253:2222

86.160.137.225:443

75.67.192.125:443

140.82.49.12:443

47.22.148.6:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3532 4436 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4436 regsvr32.exe
4436 regsvr32.exe

pid	pid_target	process	target process
3532	4436	WerFault.exe	regsvr32.exe

pid	process
4436	regsvr32.exe
4436	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4996 wrote to memory of 4436	4996	regsvr32.exe	regsvr32.exe
PID 4996 wrote to memory of 4436	4996	regsvr32.exe	regsvr32.exe
PID 4996 wrote to memory of 4436	4996	regsvr32.exe	regsvr32.exe
PID 4436 wrote to memory of 756	4436	regsvr32.exe	explorer.exe
PID 4436 wrote to memory of 756	4436	regsvr32.exe	explorer.exe
PID 4436 wrote to memory of 756	4436	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2_qakbot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4996

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2_qakbot.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 748
3⤵
- Program crash
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4436 -ip 4436
1⤵
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-132-0x0000000000000000-mapping.dmp

Download
memory/4436-133-0x0000000000530000-0x000000000056D000-memory.dmp

Filesize
244KB

Download