qakbot | fe4d2ebc920e60116b039236f07e45a9203fce4eaf7e5182c0a8610f49c7397c

Analysis

max time kernel
36s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-04-2023 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555555.dll
Size

462KB
MD5

fd4829b31ddba9d86b755d94c1bd9d18
SHA1

51888e485511fe7db278715c72da0bd64f70bc89
SHA256

fe4d2ebc920e60116b039236f07e45a9203fce4eaf7e5182c0a8610f49c7397c
SHA512

5b7d2cad80f6b6d57984fd9ecff170e023a06f316228aac961ff081965d9a9af19692e345f3cb093d75308d679c31892f735602db557ed97c514b1d39c69ae6d
SSDEEP

12288:eAsKWT98cqSemKRLh0P4Fr8qFu8wPchGF4A7J7tTFJMvEPRrUxHYjKqNZrk7UazG:eJMvArUx4jfNko9ga

Score

10^/10

qakbot obama252 1681377757 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.919

Botnet

obama252

Campaign

1681377757

70.28.50.223:2083

64.121.161.102:443

95.60.243.84:995

70.28.50.223:1194

49.245.95.124:2222

184.153.132.82:443

67.219.197.94:443

174.4.89.3:443

70.28.50.223:3389

213.91.235.146:443

75.115.14.189:443

202.142.98.62:443

70.64.77.115:443

70.28.50.223:2087

103.123.223.141:443

50.68.204.71:993

81.229.117.95:2222

72.134.124.16:443

76.170.252.153:995

85.245.221.87:2078

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

2424 ping.exe

pid	process
2424	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
772	rundll32.exe
772	rundll32.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe
436	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

772 rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exewermgr.exe

description	pid	process	target process
PID 2148 wrote to memory of 772	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 772	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 772	2148	rundll32.exe	rundll32.exe
PID 772 wrote to memory of 436	772	rundll32.exe	wermgr.exe
PID 772 wrote to memory of 436	772	rundll32.exe	wermgr.exe
PID 772 wrote to memory of 436	772	rundll32.exe	wermgr.exe
PID 772 wrote to memory of 436	772	rundll32.exe	wermgr.exe
PID 772 wrote to memory of 436	772	rundll32.exe	wermgr.exe
PID 436 wrote to memory of 2424	436	wermgr.exe	ping.exe
PID 436 wrote to memory of 2424	436	wermgr.exe	ping.exe
PID 436 wrote to memory of 2424	436	wermgr.exe	ping.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\555555.dll,Nikn
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\555555.dll,Nikn
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\ping.exe
ping -n 3 yahoo.com
4⤵
- Runs ping.exe
PID:2424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-146-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-140-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-141-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-143-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-144-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-145-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-147-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-148-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/436-149-0x00000000012D0000-0x00000000012F4000-memory.dmp

Filesize
144KB

Download
memory/772-134-0x0000000002E40000-0x0000000002E64000-memory.dmp

Filesize
144KB

Download
memory/772-139-0x0000000002E40000-0x0000000002E64000-memory.dmp

Filesize
144KB

Download
memory/772-142-0x0000000002E40000-0x0000000002E64000-memory.dmp

Filesize
144KB

Download
memory/772-133-0x0000000002D10000-0x0000000002D13000-memory.dmp

Filesize
12KB

Download