qakbot | afbbb38a5dc129911b4b7b6a2e7b67ce21293c9c48dc1589a10e6dc5660be2e7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2023, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdec8947635f7dedc753b6581983ec4eb68b161796ce0990d67a01737766c1f7.dll
Size 381KB
Sample230310-m366yada46
SHA256 cdec8947635f7dedc753b6581983ec4eb68b161796ce0990d67a01737766c1f7
MD5 2bd110d17002ecc13814cfd2fc4cd939
SHA1 99e4697e1cd3b8e92f34bada548cc59dd155eb22
SHA512 575fb0620f876a57f32a93518deeddd709b490a46f0cea5891902f222c6dd875577489c93d740d7b19b69e5e12839cd6c31b14da81a62dc5dd55fe63e831a78c
SSDEEP 6144:i4XpMMnVH+R25rka7HNpnbkUds8D1GJR8:RXvVHY25RHbks1GJR8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb18 1678346091 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.226

Botnet

BB18

Campaign

1678346091

114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	2844	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2844	rundll32.exe
2844	rundll32.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe
212	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2844	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2844	3384	rundll32.exe	87
PID 3384 wrote to memory of 2844	3384	rundll32.exe	87
PID 3384 wrote to memory of 2844	3384	rundll32.exe	87
PID 2844 wrote to memory of 212	2844	rundll32.exe	90
PID 2844 wrote to memory of 212	2844	rundll32.exe	90
PID 2844 wrote to memory of 212	2844	rundll32.exe	90
PID 2844 wrote to memory of 212	2844	rundll32.exe	90
PID 2844 wrote to memory of 212	2844	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdec8947635f7dedc753b6581983ec4eb68b161796ce0990d67a01737766c1f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdec8947635f7dedc753b6581983ec4eb68b161796ce0990d67a01737766c1f7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 612
    3⤵
    - Program crash
    PID:1808
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2844 -ip 2844
1⤵
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-143-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-144-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-149-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-141-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-146-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-140-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-142-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/212-147-0x0000000000960000-0x0000000000983000-memory.dmp

Download

memory/2844-134-0x0000000001300000-0x0000000001323000-memory.dmp

Download

memory/2844-133-0x0000000001300000-0x0000000001323000-memory.dmp

Download

memory/2844-138-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2844-137-0x0000000001300000-0x0000000001323000-memory.dmp

Download

memory/2844-136-0x0000000001300000-0x0000000001323000-memory.dmp

Download

memory/2844-135-0x0000000001270000-0x0000000001294000-memory.dmp

Download