qakbot | 09ed2cf56af8385c87f297c2a4f168efdfc78434b8a42a9122328e775f5f0400

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2023, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
church.dll
Size 334KB
Sample230531-phay4seh43
SHA256 09ed2cf56af8385c87f297c2a4f168efdfc78434b8a42a9122328e775f5f0400
MD5 0180d7f0e8c6967adb022690ff83edfd
SHA1 767d25fc2c4dabf80c3a440bba76368e758992f5
SHA512 0e90871da08aae073a5c9fea4bb7624c97494e4ccae59eadd7e3032aaca4e52251e758631f2613bbbc2cf2d224c399f97733b4ccc2035bbc83f8f6df112d1afd
SSDEEP 6144:ELh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zsjiBsTYrPlUEYD/QzkRWAFctOp6k:mInTDtXF15zsjiyZ/0tSkStJB/ts
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb30 1685526716 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1320

Botnet

BB30

Campaign

1685526716

198.2.51.242:993
88.126.94.4:50000
123.3.240.16:6881
183.87.163.165:443
27.99.32.26:2222
180.151.229.230:2078
27.109.19.90:2078
122.184.143.86:443
105.101.207.3:443
84.215.202.8:443
85.231.105.49:2222
12.172.173.82:995
184.181.75.148:443
72.134.124.16:443
149.74.159.67:2222
174.4.89.3:443
200.84.200.20:2222
223.166.13.95:995
69.133.162.35:443
80.12.88.148:2222
12.172.173.82:20
90.29.86.138:2222
124.149.143.189:2222
70.160.67.203:443
186.64.67.30:443
165.120.169.171:2222
116.74.164.144:443
92.186.69.229:2222
95.45.50.93:2222
84.35.26.14:995
89.129.109.27:2222
174.58.146.57:443
201.143.215.69:443
12.172.173.82:2087
213.55.33.103:443
50.68.204.71:443
92.239.81.124:443
64.121.161.102:443
2.82.8.80:443
47.34.30.133:443
147.147.30.126:2222
94.30.98.134:32100
188.28.19.84:443
116.120.145.170:995
79.77.142.22:2222
102.159.223.197:443
147.219.4.194:443
161.142.103.187:995
103.42.86.42:995
65.95.141.84:2222
205.237.67.69:995
103.123.223.133:443
82.127.153.75:2222
103.139.242.6:443
117.195.29.126:995
109.50.149.241:2222
161.129.37.43:443
71.38.155.217:443
58.186.75.42:443
124.122.47.148:443
220.240.164.182:443
59.28.84.65:443
79.92.15.6:443
24.234.220.88:990
96.56.197.26:2083
78.160.146.127:443
69.123.4.221:2222
76.185.109.16:443
24.234.220.88:465
76.178.148.107:2222
122.186.210.254:443
70.28.50.223:2087
178.175.187.254:443
83.110.223.61:443
125.99.76.102:443
37.14.229.220:2222
173.88.135.179:443
62.35.230.21:995
199.27.66.213:443
96.87.28.170:2222
103.87.128.228:443
176.142.207.63:443
12.172.173.82:32101
76.16.49.134:443
12.172.173.82:465
184.182.66.109:443
70.28.50.223:32100
78.92.133.215:443
50.68.204.71:993
114.143.176.236:443
70.28.50.223:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
76.170.252.153:995
69.242.31.249:443
85.104.105.67:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
81.229.117.95:2222
105.184.99.124:995
98.145.23.67:443
12.172.173.82:21
75.109.111.89:443
76.86.31.59:443
201.244.108.183:995
68.203.69.96:443
103.144.201.56:2078
151.62.238.176:443
86.248.228.57:2078
85.57.212.13:3389
91.165.188.74:50000
45.51.102.225:443
74.136.224.98:443
47.199.241.39:443
94.204.232.135:443
70.49.205.198:2222
24.234.220.88:995
70.28.50.223:2083

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	1332	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2936	PowerShell.exe
2936	PowerShell.exe
2936	PowerShell.exe
4076	rundll32.exe
4076	rundll32.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe
1484	wermgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	PowerShell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1332	3800	rundll32.exe	83
PID 3800 wrote to memory of 1332	3800	rundll32.exe	83
PID 3800 wrote to memory of 1332	3800	rundll32.exe	83
PID 2936 wrote to memory of 2156	2936	PowerShell.exe	101
PID 2936 wrote to memory of 2156	2936	PowerShell.exe	101
PID 2156 wrote to memory of 4076	2156	rundll32.exe	102
PID 2156 wrote to memory of 4076	2156	rundll32.exe	102
PID 2156 wrote to memory of 4076	2156	rundll32.exe	102
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103
PID 4076 wrote to memory of 1484	4076	rundll32.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\church.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\church.dll,#1
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 600
    3⤵
    - Program crash
    PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1332 -ip 1332
1⤵
PID:1916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3644

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" .\church.dll,next
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" .\church.dll,next
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qzwdlsrl.wlt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzwdlsrl.wlt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1484-168-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/1484-167-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/1484-169-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/1484-158-0x0000000000580000-0x0000000000582000-memory.dmp

Download

memory/1484-166-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/1484-165-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/1484-159-0x0000000000550000-0x0000000000574000-memory.dmp

Download

memory/2936-145-0x000001D6F3600000-0x000001D6F3644000-memory.dmp

Download

memory/2936-150-0x000001D6F35D0000-0x000001D6F35EE000-memory.dmp

Download

memory/2936-148-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/2936-149-0x000001D6F36D0000-0x000001D6F3746000-memory.dmp

Download

memory/2936-147-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/2936-135-0x000001D6F2450000-0x000001D6F2472000-memory.dmp

Download

memory/2936-146-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/2936-171-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/2936-172-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/2936-173-0x000001D6F24E0000-0x000001D6F24F0000-memory.dmp

Download

memory/4076-152-0x0000000002830000-0x0000000002833000-memory.dmp

Download

memory/4076-153-0x0000000002840000-0x0000000002864000-memory.dmp

Download