qakbot | 07299b663c2236db180f934446f39df675aa49a2e278aae74d332a850126024a

Analysis

max time kernel
114s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2023, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05fd5263b818a42e3f9233be6fc03ad5c1994d70a3883bb66fbfe2b3ae8fb262.dll
Size 345KB
Sample230310-nlntpsfb4s
SHA256 05fd5263b818a42e3f9233be6fc03ad5c1994d70a3883bb66fbfe2b3ae8fb262
MD5 28da37af50153bee403dc5d3f04a3721
SHA1 667776a1e737a59a1093614ac1d5787a286e2bc3
SHA512 9e68b4c900ff8c21c2a8ca1c1056e38b77d1c906cba2ce378048550a13994177933fc2cf385bb2e70daa92d530170e3fd750ce6d04ffe8ad30e187b1a73c862d
SSDEEP 6144:h4XpMMnVH+R25rka7HNlnbkUds8D1GJR8o:WXvVHY25RLbks1GJR8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb18 1678346091 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.226

Botnet

BB18

Campaign

1678346091

114.143.176.235:443
92.154.17.149:2222
2.14.45.117:2222
84.108.200.161:443
109.11.175.42:2222
88.126.94.4:50000
87.202.101.164:50000
50.68.204.71:995
49.245.82.178:2222
12.172.173.82:32101
190.11.198.76:443
79.67.165.149:995
115.87.227.49:443
84.215.202.22:443
118.250.110.98:995
66.131.25.6:443
80.1.152.201:443
198.2.51.242:993
151.48.158.236:443
50.68.204.71:993
85.61.165.153:2222
84.35.26.14:995
197.92.136.122:443
174.4.89.3:443
187.199.103.21:32103
98.37.25.99:443
184.153.132.82:443
85.59.61.52:2222
103.231.216.238:443
162.248.14.107:443
50.68.186.195:443
2.82.8.80:443
74.92.243.113:50000
80.47.61.240:2222
108.190.203.42:995
24.69.84.237:443
184.176.110.61:61202
12.172.173.82:990
12.172.173.82:465
172.90.139.138:2222
72.80.7.6:50003
50.68.204.71:443
202.186.177.88:443
183.87.163.165:443
12.172.173.82:21
24.239.69.244:443
47.21.51.138:995
174.104.184.149:443
93.147.134.85:443
136.175.69.147:443
12.172.173.82:995
73.165.119.20:443
69.133.162.35:443
12.172.173.82:20
154.246.62.48:993
92.159.173.52:2222
74.66.134.24:443
12.172.173.82:2087
190.75.151.215:2222
94.63.65.146:443
108.44.207.232:443
174.58.146.57:443
116.75.63.136:443
180.151.104.240:443
103.123.223.121:443
103.252.7.231:443
12.172.173.82:22
212.70.107.156:2222
103.111.70.115:995
49.175.72.156:443
72.203.216.98:2222
173.18.126.3:443
86.250.10.160:2222
142.161.27.232:2222
103.42.86.110:995
75.143.236.149:443
91.169.12.198:32100
64.237.221.254:443
103.71.21.107:443
103.140.174.19:2222
172.248.42.122:443
69.164.228.175:443
59.28.84.65:443
184.176.35.223:2222
202.187.95.12:995
201.244.108.183:995
103.111.70.115:443
2.50.50.227:443
27.0.48.233:443
103.141.50.102:995
86.225.214.138:2222
12.172.173.82:50001
75.156.125.215:995
116.72.250.18:443
202.142.98.62:443
47.21.51.138:443
64.229.202.224:995
202.142.98.62:995
125.99.69.178:443
217.165.230.100:2222
82.212.111.148:443
98.145.23.67:443
47.203.229.168:443
77.86.98.236:443
50.67.17.92:443
176.142.207.63:443
73.36.196.11:443
35.143.97.145:995
90.104.22.28:2222
73.22.121.210:443
82.127.204.82:2222
45.50.233.214:443
47.34.30.133:443
24.117.237.157:443
76.170.252.153:995
81.229.117.95:2222
98.163.227.79:443
86.10.146.216:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	1740	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	rundll32.exe
1740	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1740	1560	rundll32.exe	85
PID 1560 wrote to memory of 1740	1560	rundll32.exe	85
PID 1560 wrote to memory of 1740	1560	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05fd5263b818a42e3f9233be6fc03ad5c1994d70a3883bb66fbfe2b3ae8fb262.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05fd5263b818a42e3f9233be6fc03ad5c1994d70a3883bb66fbfe2b3ae8fb262.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 620
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1740 -ip 1740
1⤵
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-133-0x00000000012D0000-0x00000000012F3000-memory.dmp

Download

memory/1740-134-0x00000000012D0000-0x00000000012F3000-memory.dmp

Download

memory/1740-135-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Download

memory/1740-136-0x00000000012D0000-0x00000000012F3000-memory.dmp

Download

memory/1740-138-0x0000000000400000-0x0000000000458000-memory.dmp

Download