qakbot | 402dc9f0deb84bc6a911e6a13a953a6049e9eb79203968ca5cb123b21dd349f4

Analysis

max time kernel
90s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

387773.dat.dll
Size

582KB
MD5

c1a91d62c48fb71cbebdaf4011e6ae38
SHA1

a82d3b683285a6ec79252887f8e9513c645a6909
SHA256

402dc9f0deb84bc6a911e6a13a953a6049e9eb79203968ca5cb123b21dd349f4
SHA512

5eae1284458c7af62a35ff57490e4f2c054a622e333bf615d8137b7910c6a4e43075337e581ab2ccf53cf15526fdf0f5d2534274b9c4467c75372335ad94228c
SSDEEP

12288:fZa7ZPnVubJS4NjeWC585yteLnr2zlSz6:he5VuY1H85ubSe

Score

10^/10

qakbot obama240 1676465313 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.510

Botnet

obama240

Campaign

1676465313

87.221.197.113:2222

76.20.42.45:443

86.207.227.152:2222

109.11.175.42:2222

41.228.236.143:995

51.37.173.153:443

24.206.27.39:443

116.72.250.18:443

80.3.209.218:443

82.36.36.76:443

12.172.173.82:2087

176.142.207.63:443

66.35.126.223:2222

12.172.173.82:995

24.239.69.244:443

68.108.122.180:443

173.18.126.3:443

156.216.125.255:995

24.71.120.191:443

73.165.119.20:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2972	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	rundll32.exe
2972	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2972	3008	rundll32.exe	79
PID 3008 wrote to memory of 2972	3008	rundll32.exe	79
PID 3008 wrote to memory of 2972	3008	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\387773.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\387773.dat.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 620
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2972 -ip 2972
1⤵
PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-133-0x0000000002A10000-0x0000000002A33000-memory.dmp

Filesize
140KB

Download
memory/2972-134-0x00000000029B0000-0x00000000029D4000-memory.dmp

Filesize
144KB

Download
memory/2972-135-0x0000000002A10000-0x0000000002A33000-memory.dmp

Filesize
140KB

Download