qakbot | fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a

Analysis

max time kernel
159s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
30-05-2023 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a.dll
Size

817KB
MD5

7db2241ddce77297d6a6fd44c57386a7
SHA1

6565677c9ccf0805af012b641d2a75354ed290d6
SHA256

fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a
SHA512

a42ed635d896b5b7ef8200facdf4b90e236afd83cc02b492be702ffd23bb475816776a2b462ed1b16975b7317b3d59eeeeba919e6458973a0161aa6a18a99d70
SSDEEP

12288:JJGwvTfCMf8rVomRle7XBr4fi7wDqo4TARMhxMrFND648j4xhT6dl:JY5rVtcsfi7wDP4TAR0sFN+Ux

Score

10^/10

qakbot azd 1671805456 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.62

Botnet

azd

Campaign

1671805456

79.77.142.22:2222

70.51.134.110:2222

156.217.79.168:995

93.156.98.4:443

108.6.249.139:443

89.152.120.181:443

152.170.17.136:443

83.248.199.56:443

136.35.241.159:443

72.200.109.104:443

84.113.121.103:443

38.166.41.88:2087

173.178.151.233:443

85.72.107.2:2222

91.254.132.23:443

195.198.103.184:443

96.255.66.51:995

178.142.126.181:443

176.142.207.63:443

199.83.165.233:443

Attributes

salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4920 1656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4920	1656	WerFault.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

rundll32.exewermgr.exe

pid	process
3116	rundll32.exe
3116	rundll32.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe
3904	wermgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3116 rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rundll32.execmd.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2556 wrote to memory of 1656	2556	rundll32.exe	rundll32.exe
PID 2556 wrote to memory of 1656	2556	rundll32.exe	rundll32.exe
PID 2556 wrote to memory of 1656	2556	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 4824	4728	cmd.exe	rundll32.exe
PID 4728 wrote to memory of 4824	4728	cmd.exe	rundll32.exe
PID 4824 wrote to memory of 3116	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 3116	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 3116	4824	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 3904	3116	rundll32.exe	wermgr.exe
PID 3116 wrote to memory of 3904	3116	rundll32.exe	wermgr.exe
PID 3116 wrote to memory of 3904	3116	rundll32.exe	wermgr.exe
PID 3116 wrote to memory of 3904	3116	rundll32.exe	wermgr.exe
PID 3116 wrote to memory of 3904	3116	rundll32.exe	wermgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb79d3aa7ee29b7a6dca44bc061abbe521089edb79d6596ada71b05c64b4a8a.dll,#1
2⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 632
3⤵
- Program crash
PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2608

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\system32\rundll32.exe
rundll32.exe f.dll,Updt
2⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe f.dll,Updt
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-117-0x000000006C540000-0x000000006C613000-memory.dmp

Filesize
844KB

Download
memory/3116-119-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/3116-124-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/3116-125-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/3116-126-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/3904-128-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-131-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-132-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-133-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-134-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-135-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download
memory/3904-136-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download