qakbot | 9d5a6f8128c1aa59e04a4a32817f505be6fbdce63e5dd70f12706b587790b5a0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
parachute.dll
Size 362KB
Sample230601-hzev3ada87
SHA256 9d5a6f8128c1aa59e04a4a32817f505be6fbdce63e5dd70f12706b587790b5a0
MD5 637a93e696044ba0dc752d4611c83955
SHA1 b34d01c283978871d8370f11c5747c25dd678931
SHA512 9b74c6326a8aa72ef3c2af3d8882231d87f7c3300f6214658ae6a92706cba259a90d02eac653618b2ede4f16800392639a89b5bed3d715a3986572e7f2d1d55e
SSDEEP 6144:PLh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zs7iBsTYrPlUEYD/QzkRWAFctOp6E:TInTDtXF15zs7iyZ/0tUS1CU3BJbwP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

qakbot bb30 1685526716 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

404.1320

Botnet

BB30

Campaign

1685526716

198.2.51.242:993
88.126.94.4:50000
123.3.240.16:6881
183.87.163.165:443
27.99.32.26:2222
180.151.229.230:2078
27.109.19.90:2078
122.184.143.86:443
105.101.207.3:443
84.215.202.8:443
85.231.105.49:2222
12.172.173.82:995
184.181.75.148:443
72.134.124.16:443
149.74.159.67:2222
174.4.89.3:443
200.84.200.20:2222
223.166.13.95:995
69.133.162.35:443
80.12.88.148:2222
12.172.173.82:20
90.29.86.138:2222
124.149.143.189:2222
70.160.67.203:443
186.64.67.30:443
165.120.169.171:2222
116.74.164.144:443
92.186.69.229:2222
95.45.50.93:2222
84.35.26.14:995
89.129.109.27:2222
174.58.146.57:443
201.143.215.69:443
12.172.173.82:2087
213.55.33.103:443
50.68.204.71:443
92.239.81.124:443
64.121.161.102:443
2.82.8.80:443
47.34.30.133:443
147.147.30.126:2222
94.30.98.134:32100
188.28.19.84:443
116.120.145.170:995
79.77.142.22:2222
102.159.223.197:443
147.219.4.194:443
161.142.103.187:995
103.42.86.42:995
65.95.141.84:2222
205.237.67.69:995
103.123.223.133:443
82.127.153.75:2222
103.139.242.6:443
117.195.29.126:995
109.50.149.241:2222
161.129.37.43:443
71.38.155.217:443
58.186.75.42:443
124.122.47.148:443
220.240.164.182:443
59.28.84.65:443
79.92.15.6:443
24.234.220.88:990
96.56.197.26:2083
78.160.146.127:443
69.123.4.221:2222
76.185.109.16:443
24.234.220.88:465
76.178.148.107:2222
122.186.210.254:443
70.28.50.223:2087
178.175.187.254:443
83.110.223.61:443
125.99.76.102:443
37.14.229.220:2222
173.88.135.179:443
62.35.230.21:995
199.27.66.213:443
96.87.28.170:2222
103.87.128.228:443
176.142.207.63:443
12.172.173.82:32101
76.16.49.134:443
12.172.173.82:465
184.182.66.109:443
70.28.50.223:32100
78.92.133.215:443
50.68.204.71:993
114.143.176.236:443
70.28.50.223:3389
50.68.186.195:443
47.205.25.170:443
12.172.173.82:993
76.170.252.153:995
69.242.31.249:443
85.104.105.67:443
79.168.224.165:2222
75.143.236.149:443
14.192.241.76:995
81.229.117.95:2222
105.184.99.124:995
98.145.23.67:443
12.172.173.82:21
75.109.111.89:443
76.86.31.59:443
201.244.108.183:995
68.203.69.96:443
103.144.201.56:2078
151.62.238.176:443
86.248.228.57:2078
85.57.212.13:3389
91.165.188.74:50000
45.51.102.225:443
74.136.224.98:443
47.199.241.39:443
94.204.232.135:443
70.49.205.198:2222
24.234.220.88:995
70.28.50.223:2083

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	3564	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1156	PowerShell.exe
1156	PowerShell.exe
1156	PowerShell.exe
2532	rundll32.exe
2532	rundll32.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe
4348	wermgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	PowerShell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3564	1364	rundll32.exe	83
PID 1364 wrote to memory of 3564	1364	rundll32.exe	83
PID 1364 wrote to memory of 3564	1364	rundll32.exe	83
PID 1156 wrote to memory of 2576	1156	PowerShell.exe	101
PID 1156 wrote to memory of 2576	1156	PowerShell.exe	101
PID 2576 wrote to memory of 2532	2576	rundll32.exe	102
PID 2576 wrote to memory of 2532	2576	rundll32.exe	102
PID 2576 wrote to memory of 2532	2576	rundll32.exe	102
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103
PID 2532 wrote to memory of 4348	2532	rundll32.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\parachute.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\parachute.dll,#1
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 600
    3⤵
    - Program crash
    PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3564 -ip 3564
1⤵
PID:3548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1972

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" .\parachute.dll,next
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" .\parachute.dll,next
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\wermgr.exe
      C:\Windows\SysWOW64\wermgr.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_lcr35lao.kcy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lcr35lao.kcy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1156-149-0x0000016F6AFE0000-0x0000016F6B056000-memory.dmp

Download

memory/1156-145-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/1156-146-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/1156-147-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/1156-148-0x0000016F6AF10000-0x0000016F6AF54000-memory.dmp

Download

memory/1156-171-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/1156-150-0x0000016F6AEE0000-0x0000016F6AEFE000-memory.dmp

Download

memory/1156-140-0x0000016F69D80000-0x0000016F69DA2000-memory.dmp

Download

memory/1156-173-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/1156-172-0x0000016F696A0000-0x0000016F696B0000-memory.dmp

Download

memory/2532-152-0x0000000002550000-0x0000000002553000-memory.dmp

Download

memory/2532-153-0x00000000025F0000-0x0000000002614000-memory.dmp

Download

memory/4348-158-0x0000000000690000-0x0000000000692000-memory.dmp

Download

memory/4348-167-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-170-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-169-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-168-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-166-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-165-0x0000000000660000-0x0000000000684000-memory.dmp

Download

memory/4348-159-0x0000000000660000-0x0000000000684000-memory.dmp

Download