qakbot | 5210ddc4a86cbdaf74d1c3c4e1ec16855cb7a8bd9afb3894932e31eafbfb1062

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2022 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccc80c73061729902431bf2fb0238df8f2a2da34b1d1bb7497e27c089c215272.dll
Size

695KB
MD5

ef0b0131dd0bc88c113b17f9049e8fb3
SHA1

8269f5fafb9d88d15a821d9311c8659148f854f7
SHA256

ccc80c73061729902431bf2fb0238df8f2a2da34b1d1bb7497e27c089c215272
SHA512

a06e89f706f7c0712146102424d94fa254282b8b49563f896d55dfa324610e5492bb6ba061e774ccb7983d269e315ee52e8c2344a5ff0fb0cfe4094ebfe524fd
SSDEEP

12288:nieL1vc1PdFjpmw5qS6xnGWnE/N285UT+QD1lNMA:i81IFnqnnEl5w9M

Score

10^/10

qakbot obama207 1664363417 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

obama207

Campaign

1664363417

217.165.146.158:993

41.97.179.58:443

86.132.13.49:2078

197.203.50.195:443

85.245.143.94:443

86.196.181.62:2222

102.190.190.242:995

105.184.133.198:995

179.111.23.186:32101

179.251.119.206:995

84.3.85.30:443

39.44.5.104:995

197.41.235.69:995

193.3.19.137:443

186.81.122.168:443

103.173.121.17:443

41.104.80.233:443

102.189.184.12:995

156.199.90.139:443

14.168.180.223:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	5072	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	rundll32.exe
5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc80c73061729902431bf2fb0238df8f2a2da34b1d1bb7497e27c089c215272.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc80c73061729902431bf2fb0238df8f2a2da34b1d1bb7497e27c089c215272.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 668
    3⤵
    - Program crash
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5072 -ip 5072
1⤵
PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-133-0x0000000002E80000-0x0000000002EA2000-memory.dmp

Filesize
136KB

Download
memory/5072-134-0x0000000002E30000-0x0000000002E72000-memory.dmp

Filesize
264KB

Download
memory/5072-135-0x0000000002E80000-0x0000000002EA2000-memory.dmp

Filesize
136KB

Download