qakbot | 0c0bcbf672156c692cc607f862051519ea99836fd3d90a451b049a46949e5893

Analysis

max time kernel
149s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2023, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
borisandhisferrari.dll
Size 905KB
Sample230223-bc5dwagb4t
SHA256 0c0bcbf672156c692cc607f862051519ea99836fd3d90a451b049a46949e5893
MD5 3e662177f4dee632b2fac01ac68824d9
SHA1 78670d5d2f5d58863c34987d70c316a620015c7a
SHA512 d9777686b5bcdd22d2a9dcb5dd3dd03832feb4481a2402389226c7a3ae2b79d2f699a61c1a1ea14c54a5fcb491d5320d426504bbd873d21dc4b630652fc23ab7
SSDEEP 12288:rrhxV/xG39fx1jGrJySlVB7qZcsyc1m41OSoMhKmkxgt9peTI95kKZPP+Hmm:xxRQfXsy0BTP4gSoMZttvWQ5k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb16 1677046917 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.9

Botnet

BB16

Campaign

1677046917

47.21.51.138:443
72.80.7.6:50003
82.127.204.82:2222
49.175.72.56:443
201.244.108.183:995
122.184.143.82:443
102.156.253.86:443
74.58.71.237:443
47.21.51.138:995
77.86.98.236:443
71.31.101.183:443
136.232.184.134:995
86.225.214.138:2222
95.242.101.251:995
109.11.175.42:2222
90.78.138.217:2222
184.176.35.223:2222
35.143.97.145:995
202.186.177.88:443
114.79.180.14:995
86.150.47.219:443
183.87.163.165:443
50.68.186.195:443
190.75.95.164:2222
98.145.23.67:443
67.10.175.47:2222
71.212.147.224:2222
88.126.94.4:50000
103.140.174.19:2222
103.231.216.238:443
78.84.123.237:995
180.151.108.14:443
80.47.57.131:2222
198.2.51.242:993
50.68.204.71:995
205.164.227.222:443
147.219.4.194:443
77.124.6.149:443
49.245.82.178:2222
46.10.198.107:443
76.80.180.154:995
12.172.173.82:32101
68.150.18.161:443
68.173.170.110:8443
24.9.220.167:443
12.172.173.82:2087
50.68.204.71:993
107.146.12.26:2222
81.229.117.95:2222
27.0.48.233:443
69.133.162.35:443
59.28.84.65:443
76.170.252.153:995
89.32.159.192:995
202.142.98.62:995
73.78.215.104:443
181.164.217.211:443
92.97.203.51:2222
116.74.164.26:443
103.141.50.102:995
149.74.159.67:2222
116.72.250.18:443
125.99.69.178:443
202.142.98.62:443
67.61.71.201:443
103.123.223.168:443
80.13.205.69:2222
80.0.74.165:443
86.99.54.39:2222
213.67.255.57:2222
176.142.207.63:443
50.67.17.92:443
217.165.1.53:2222
70.64.77.115:443
2.50.47.74:443
66.191.69.18:995
75.143.236.149:443
197.92.136.122:443
108.190.203.42:995
50.68.204.71:443
12.172.173.82:995
70.77.116.233:443
162.248.14.107:443
75.98.154.19:443
58.247.115.126:995
184.68.116.146:61202
41.99.50.76:443
184.68.116.146:3389
72.203.216.98:2222
103.252.7.231:443
12.172.173.82:50001
70.160.80.210:443
12.172.173.82:465
12.172.173.82:21
47.34.30.133:443
202.187.232.161:995
98.147.155.235:443
124.122.56.144:443
75.141.227.169:443
103.144.201.53:2078
172.248.42.122:443
12.172.173.82:990
24.239.69.244:443
173.18.126.3:443
73.165.119.20:443
90.104.22.28:2222
14.192.241.76:995
74.33.196.114:443
74.93.148.97:995
86.202.48.142:2222
174.104.184.149:443
12.172.173.82:20
109.151.144.37:443
104.35.24.154:443
114.143.176.234:443
84.35.26.14:995
45.50.233.214:443
64.237.185.60:443
73.161.176.218:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1548	4960	WerFault.exe	82
2572	4960	WerFault.exe	82
3748	1408	WerFault.exe	96
4528	1640	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1408	rundll32.exe
1408	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe
3724	wermgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1408	rundll32.exe
1640	rundll32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4960	4944	rundll32.exe	82
PID 4944 wrote to memory of 4960	4944	rundll32.exe	82
PID 4944 wrote to memory of 4960	4944	rundll32.exe	82
PID 5020 wrote to memory of 1832	5020	cmd.exe	94
PID 5020 wrote to memory of 1832	5020	cmd.exe	94
PID 5020 wrote to memory of 1156	5020	cmd.exe	95
PID 5020 wrote to memory of 1156	5020	cmd.exe	95
PID 1832 wrote to memory of 1408	1832	rundll32.exe	96
PID 1832 wrote to memory of 1408	1832	rundll32.exe	96
PID 1832 wrote to memory of 1408	1832	rundll32.exe	96
PID 1156 wrote to memory of 1640	1156	rundll32.exe	97
PID 1156 wrote to memory of 1640	1156	rundll32.exe	97
PID 1156 wrote to memory of 1640	1156	rundll32.exe	97
PID 1408 wrote to memory of 3948	1408	rundll32.exe	102
PID 1408 wrote to memory of 3948	1408	rundll32.exe	102
PID 1408 wrote to memory of 3948	1408	rundll32.exe	102
PID 1408 wrote to memory of 3948	1408	rundll32.exe	102
PID 1408 wrote to memory of 3948	1408	rundll32.exe	102
PID 1640 wrote to memory of 3724	1640	rundll32.exe	103
PID 1640 wrote to memory of 3724	1640	rundll32.exe	103
PID 1640 wrote to memory of 3724	1640	rundll32.exe	103
PID 1640 wrote to memory of 3724	1640	rundll32.exe	103
PID 1640 wrote to memory of 3724	1640	rundll32.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\borisandhisferrari.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\borisandhisferrari.dll,#1
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 540
    3⤵
    - Program crash
    PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 600
    3⤵
    - Program crash
    PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4960 -ip 4960
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4960 -ip 4960
1⤵
PID:1176

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\system32\rundll32.exe
  rundll32 borisandhisferrari.dll,N115
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 borisandhisferrari.dll,N115
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 556
      4⤵
      Program crash
      PID:3748
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      PID:3948
- C:\Windows\system32\rundll32.exe
  rundll32 borisandhisferrari.dll,N115
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 borisandhisferrari.dll,N115
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 560
      4⤵
      Program crash
      PID:4528
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1408 -ip 1408
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1640 -ip 1640
1⤵
PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

borisandhisferrari.dll

Path C:\Users\Admin\AppData\Local\Temp\borisandhisferrari.dll
Size 4KB
SHA256 f6664773bdc706b790cdd2257bc261c8f2188c2cde5752eb209a3087f75a4e2d
MD5 bbdcdc37239e568ce41a2e1f36baf18a
SHA1 307369d5c4be6b94c1979b5ffae189d802464ab2
SHA512 2439d48192cbb3e93420b29603ea050d6aa1ae8bb8550a16f68bb761fb1a7a88d205da9a0ab6432542b120040fca6f4281629042d7797fc5a8160fc56cbf189a
MD5 SHA1 SHA512

Submit Download

memory/1408-134-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1408-139-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1408-146-0x0000000000DB0000-0x0000000000DB3000-memory.dmp

Download

memory/1408-147-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1640-145-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1640-148-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/3724-158-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-154-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-157-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-159-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-160-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-162-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3724-163-0x0000000000340000-0x0000000000363000-memory.dmp

Download

memory/3948-155-0x0000000000460000-0x0000000000483000-memory.dmp

Download

memory/3948-156-0x0000000000460000-0x0000000000483000-memory.dmp

Download

memory/4960-133-0x000000006D700000-0x000000006D7D1000-memory.dmp

Download